1 """Restricted execution facilities.

     2 

     3 The class RExec exports methods r_exec(), r_eval(), r_execfile(), and

     4 r_import(), which correspond roughly to the built-in operations

     5 exec, eval(), execfile() and import, but executing the code in an

     6 environment that only exposes those built-in operations that are

     7 deemed safe.  To this end, a modest collection of 'fake' modules is

     8 created which mimics the standard modules by the same names.  It is a

     9 policy decision which built-in modules and operations are made

    10 available; this module provides a reasonable default, but derived

    11 classes can change the policies e.g. by overriding or extending class

    12 variables like ok_builtin_modules or methods like make_sys().

    13 

    14 XXX To do:

    15 - r_open should allow writing tmp dir

    16 - r_exec etc. with explicit globals/locals? (Use rexec("exec ... in ...")?)

    17 

    18 """

    19 from warnings import warnpy3k

    20 warnpy3k("the rexec module has been removed in Python 3.0", stacklevel=2)

    21 del warnpy3k

    22 

    23 

    24 import sys

    25 import __builtin__

    26 import os

    27 import ihooks

    28 import imp

    29 

    30 __all__ = ["RExec"]

    31 

    32 class FileBase:

    33 

    34     ok_file_methods = ('fileno', 'flush', 'isatty', 'read', 'readline',

    35             'readlines', 'seek', 'tell', 'write', 'writelines', 'xreadlines',

    36             '__iter__')

    37 

    38 

    39 class FileWrapper(FileBase):

    40 

    41     # XXX This is just like a Bastion -- should use that!

    42 

    43     def __init__(self, f):

    44         for m in self.ok_file_methods:

    45             if not hasattr(self, m) and hasattr(f, m):

    46                 setattr(self, m, getattr(f, m))

    47 

    48     def close(self):

    49         self.flush()

    50 

    51 

    52 TEMPLATE = """

    53 def %s(self, *args):

    54         return getattr(self.mod, self.name).%s(*args)

    55 """

    56 

    57 class FileDelegate(FileBase):

    58 

    59     def __init__(self, mod, name):

    60         self.mod = mod

    61         self.name = name

    62 

    63     for m in FileBase.ok_file_methods + ('close',):

    64         exec TEMPLATE % (m, m)

    65 

    66 

    67 class RHooks(ihooks.Hooks):

    68 

    69     def __init__(self, *args):

    70         # Hacks to support both old and new interfaces:

    71         # old interface was RHooks(rexec[, verbose])

    72         # new interface is RHooks([verbose])

    73         verbose = 0

    74         rexec = None

    75         if args and type(args[-1]) == type(0):

    76             verbose = args[-1]

    77             args = args[:-1]

    78         if args and hasattr(args[0], '__class__'):

    79             rexec = args[0]

    80             args = args[1:]

    81         if args:

    82             raise TypeError, "too many arguments"

    83         ihooks.Hooks.__init__(self, verbose)

    84         self.rexec = rexec

    85 

    86     def set_rexec(self, rexec):

    87         # Called by RExec instance to complete initialization

    88         self.rexec = rexec

    89 

    90     def get_suffixes(self):

    91         return self.rexec.get_suffixes()

    92 

    93     def is_builtin(self, name):

    94         return self.rexec.is_builtin(name)

    95 

    96     def init_builtin(self, name):

    97         m = __import__(name)

    98         return self.rexec.copy_except(m, ())

    99 

   100     def init_frozen(self, name): raise SystemError, "don't use this"

   101     def load_source(self, *args): raise SystemError, "don't use this"

   102     def load_compiled(self, *args): raise SystemError, "don't use this"

   103     def load_package(self, *args): raise SystemError, "don't use this"

   104 

   105     def load_dynamic(self, name, filename, file):

   106         return self.rexec.load_dynamic(name, filename, file)

   107 

   108     def add_module(self, name):

   109         return self.rexec.add_module(name)

   110 

   111     def modules_dict(self):

   112         return self.rexec.modules

   113 

   114     def default_path(self):

   115         return self.rexec.modules['sys'].path

   116 

   117 

   118 # XXX Backwards compatibility

   119 RModuleLoader = ihooks.FancyModuleLoader

   120 RModuleImporter = ihooks.ModuleImporter

   121 

   122 

   123 class RExec(ihooks._Verbose):

   124     """Basic restricted execution framework.

   125 

   126     Code executed in this restricted environment will only have access to

   127     modules and functions that are deemed safe; you can subclass RExec to

   128     add or remove capabilities as desired.

   129 

   130     The RExec class can prevent code from performing unsafe operations like

   131     reading or writing disk files, or using TCP/IP sockets.  However, it does

   132     not protect against code using extremely large amounts of memory or

   133     processor time.

   134 

   135     """

   136 

   137     ok_path = tuple(sys.path)           # That's a policy decision

   138 

   139     ok_builtin_modules = ('audioop', 'array', 'binascii',

   140                           'cmath', 'errno', 'imageop',

   141                           'marshal', 'math', 'md5', 'operator',

   142                           'parser', 'select',

   143                           'sha', '_sre', 'strop', 'struct', 'time',

   144                           '_weakref')

   145 

   146     ok_posix_names = ('error', 'fstat', 'listdir', 'lstat', 'readlink',

   147                       'stat', 'times', 'uname', 'getpid', 'getppid',

   148                       'getcwd', 'getuid', 'getgid', 'geteuid', 'getegid')

   149 

   150     ok_sys_names = ('byteorder', 'copyright', 'exit', 'getdefaultencoding',

   151                     'getrefcount', 'hexversion', 'maxint', 'maxunicode',

   152                     'platform', 'ps1', 'ps2', 'version', 'version_info')

   153 

   154     nok_builtin_names = ('open', 'file', 'reload', '__import__')

   155 

   156     ok_file_types = (imp.C_EXTENSION, imp.PY_SOURCE)

   157 

   158     def __init__(self, hooks = None, verbose = 0):

   159         """Returns an instance of the RExec class.

   160 

   161         The hooks parameter is an instance of the RHooks class or a subclass

   162         of it.  If it is omitted or None, the default RHooks class is

   163         instantiated.

   164 

   165         Whenever the RExec module searches for a module (even a built-in one)

   166         or reads a module's code, it doesn't actually go out to the file

   167         system itself.  Rather, it calls methods of an RHooks instance that

   168         was passed to or created by its constructor.  (Actually, the RExec

   169         object doesn't make these calls --- they are made by a module loader

   170         object that's part of the RExec object.  This allows another level of

   171         flexibility, which can be useful when changing the mechanics of

   172         import within the restricted environment.)

   173 

   174         By providing an alternate RHooks object, we can control the file

   175         system accesses made to import a module, without changing the

   176         actual algorithm that controls the order in which those accesses are

   177         made.  For instance, we could substitute an RHooks object that

   178         passes all filesystem requests to a file server elsewhere, via some

   179         RPC mechanism such as ILU.  Grail's applet loader uses this to support

   180         importing applets from a URL for a directory.

   181 

   182         If the verbose parameter is true, additional debugging output may be

   183         sent to standard output.

   184 

   185         """

   186 

   187         raise RuntimeError, "This code is not secure in Python 2.2 and later"

   188 

   189         ihooks._Verbose.__init__(self, verbose)

   190         # XXX There's a circular reference here:

   191         self.hooks = hooks or RHooks(verbose)

   192         self.hooks.set_rexec(self)

   193         self.modules = {}

   194         self.ok_dynamic_modules = self.ok_builtin_modules

   195         list = []

   196         for mname in self.ok_builtin_modules:

   197             if mname in sys.builtin_module_names:

   198                 list.append(mname)

   199         self.ok_builtin_modules = tuple(list)

   200         self.set_trusted_path()

   201         self.make_builtin()

   202         self.make_initial_modules()

   203         # make_sys must be last because it adds the already created

   204         # modules to its builtin_module_names

   205         self.make_sys()

   206         self.loader = RModuleLoader(self.hooks, verbose)

   207         self.importer = RModuleImporter(self.loader, verbose)

   208 

   209     def set_trusted_path(self):

   210         # Set the path from which dynamic modules may be loaded.

   211         # Those dynamic modules must also occur in ok_builtin_modules

   212         self.trusted_path = filter(os.path.isabs, sys.path)

   213 

   214     def load_dynamic(self, name, filename, file):

   215         if name not in self.ok_dynamic_modules:

   216             raise ImportError, "untrusted dynamic module: %s" % name

   217         if name in sys.modules:

   218             src = sys.modules[name]

   219         else:

   220             src = imp.load_dynamic(name, filename, file)

   221         dst = self.copy_except(src, [])

   222         return dst

   223 

   224     def make_initial_modules(self):

   225         self.make_main()

   226         self.make_osname()

   227 

   228     # Helpers for RHooks

   229 

   230     def get_suffixes(self):

   231         return [item   # (suff, mode, type)

   232                 for item in imp.get_suffixes()

   233                 if item[2] in self.ok_file_types]

   234 

   235     def is_builtin(self, mname):

   236         return mname in self.ok_builtin_modules

   237 

   238     # The make_* methods create specific built-in modules

   239 

   240     def make_builtin(self):

   241         m = self.copy_except(__builtin__, self.nok_builtin_names)

   242         m.__import__ = self.r_import

   243         m.reload = self.r_reload

   244         m.open = m.file = self.r_open

   245 

   246     def make_main(self):

   247         m = self.add_module('__main__')

   248 

   249     def make_osname(self):

   250         osname = os.name

   251         src = __import__(osname)

   252         dst = self.copy_only(src, self.ok_posix_names)

   253         dst.environ = e = {}

   254         for key, value in os.environ.items():

   255             e[key] = value

   256 

   257     def make_sys(self):

   258         m = self.copy_only(sys, self.ok_sys_names)

   259         m.modules = self.modules

   260         m.argv = ['RESTRICTED']

   261         m.path = map(None, self.ok_path)

   262         m.exc_info = self.r_exc_info

   263         m = self.modules['sys']

   264         l = self.modules.keys() + list(self.ok_builtin_modules)

   265         l.sort()

   266         m.builtin_module_names = tuple(l)

   267 

   268     # The copy_* methods copy existing modules with some changes

   269 

   270     def copy_except(self, src, exceptions):

   271         dst = self.copy_none(src)

   272         for name in dir(src):

   273             setattr(dst, name, getattr(src, name))

   274         for name in exceptions:

   275             try:

   276                 delattr(dst, name)

   277             except AttributeError:

   278                 pass

   279         return dst

   280 

   281     def copy_only(self, src, names):

   282         dst = self.copy_none(src)

   283         for name in names:

   284             try:

   285                 value = getattr(src, name)

   286             except AttributeError:

   287                 continue

   288             setattr(dst, name, value)

   289         return dst

   290 

   291     def copy_none(self, src):

   292         m = self.add_module(src.__name__)

   293         m.__doc__ = src.__doc__

   294         return m

   295 

   296     # Add a module -- return an existing module or create one

   297 

   298     def add_module(self, mname):

   299         m = self.modules.get(mname)

   300         if m is None:

   301             self.modules[mname] = m = self.hooks.new_module(mname)

   302         m.__builtins__ = self.modules['__builtin__']

   303         return m

   304 

   305     # The r* methods are public interfaces

   306 

   307     def r_exec(self, code):

   308         """Execute code within a restricted environment.

   309 

   310         The code parameter must either be a string containing one or more

   311         lines of Python code, or a compiled code object, which will be

   312         executed in the restricted environment's __main__ module.

   313 

   314         """

   315         m = self.add_module('__main__')

   316         exec code in m.__dict__

   317 

   318     def r_eval(self, code):

   319         """Evaluate code within a restricted environment.

   320 

   321         The code parameter must either be a string containing a Python

   322         expression, or a compiled code object, which will be evaluated in

   323         the restricted environment's __main__ module.  The value of the

   324         expression or code object will be returned.

   325 

   326         """

   327         m = self.add_module('__main__')

   328         return eval(code, m.__dict__)

   329 

   330     def r_execfile(self, file):

   331         """Execute the Python code in the file in the restricted

   332         environment's __main__ module.

   333 

   334         """

   335         m = self.add_module('__main__')

   336         execfile(file, m.__dict__)

   337 

   338     def r_import(self, mname, globals={}, locals={}, fromlist=[]):

   339         """Import a module, raising an ImportError exception if the module

   340         is considered unsafe.

   341 

   342         This method is implicitly called by code executing in the

   343         restricted environment.  Overriding this method in a subclass is

   344         used to change the policies enforced by a restricted environment.

   345 

   346         """

   347         return self.importer.import_module(mname, globals, locals, fromlist)

   348 

   349     def r_reload(self, m):

   350         """Reload the module object, re-parsing and re-initializing it.

   351 

   352         This method is implicitly called by code executing in the

   353         restricted environment.  Overriding this method in a subclass is

   354         used to change the policies enforced by a restricted environment.

   355 

   356         """

   357         return self.importer.reload(m)

   358 

   359     def r_unload(self, m):

   360         """Unload the module.

   361 

   362         Removes it from the restricted environment's sys.modules dictionary.

   363 

   364         This method is implicitly called by code executing in the

   365         restricted environment.  Overriding this method in a subclass is

   366         used to change the policies enforced by a restricted environment.

   367 

   368         """

   369         return self.importer.unload(m)

   370 

   371     # The s_* methods are similar but also swap std{in,out,err}

   372 

   373     def make_delegate_files(self):

   374         s = self.modules['sys']

   375         self.delegate_stdin = FileDelegate(s, 'stdin')

   376         self.delegate_stdout = FileDelegate(s, 'stdout')

   377         self.delegate_stderr = FileDelegate(s, 'stderr')

   378         self.restricted_stdin = FileWrapper(sys.stdin)

   379         self.restricted_stdout = FileWrapper(sys.stdout)

   380         self.restricted_stderr = FileWrapper(sys.stderr)

   381 

   382     def set_files(self):

   383         if not hasattr(self, 'save_stdin'):

   384             self.save_files()

   385         if not hasattr(self, 'delegate_stdin'):

   386             self.make_delegate_files()

   387         s = self.modules['sys']

   388         s.stdin = self.restricted_stdin

   389         s.stdout = self.restricted_stdout

   390         s.stderr = self.restricted_stderr

   391         sys.stdin = self.delegate_stdin

   392         sys.stdout = self.delegate_stdout

   393         sys.stderr = self.delegate_stderr

   394 

   395     def reset_files(self):

   396         self.restore_files()

   397         s = self.modules['sys']

   398         self.restricted_stdin = s.stdin

   399         self.restricted_stdout = s.stdout

   400         self.restricted_stderr = s.stderr

   401 

   402 

   403     def save_files(self):

   404         self.save_stdin = sys.stdin

   405         self.save_stdout = sys.stdout

   406         self.save_stderr = sys.stderr

   407 

   408     def restore_files(self):

   409         sys.stdin = self.save_stdin

   410         sys.stdout = self.save_stdout

   411         sys.stderr = self.save_stderr

   412 

   413     def s_apply(self, func, args=(), kw={}):

   414         self.save_files()

   415         try:

   416             self.set_files()

   417             r = func(*args, **kw)

   418         finally:

   419             self.restore_files()

   420         return r

   421 

   422     def s_exec(self, *args):

   423         """Execute code within a restricted environment.

   424 

   425         Similar to the r_exec() method, but the code will be granted access

   426         to restricted versions of the standard I/O streams sys.stdin,

   427         sys.stderr, and sys.stdout.

   428 

   429         The code parameter must either be a string containing one or more

   430         lines of Python code, or a compiled code object, which will be

   431         executed in the restricted environment's __main__ module.

   432 

   433         """

   434         return self.s_apply(self.r_exec, args)

   435 

   436     def s_eval(self, *args):

   437         """Evaluate code within a restricted environment.

   438 

   439         Similar to the r_eval() method, but the code will be granted access

   440         to restricted versions of the standard I/O streams sys.stdin,

   441         sys.stderr, and sys.stdout.

   442 

   443         The code parameter must either be a string containing a Python

   444         expression, or a compiled code object, which will be evaluated in

   445         the restricted environment's __main__ module.  The value of the

   446         expression or code object will be returned.

   447 

   448         """

   449         return self.s_apply(self.r_eval, args)

   450 

   451     def s_execfile(self, *args):

   452         """Execute the Python code in the file in the restricted

   453         environment's __main__ module.

   454 

   455         Similar to the r_execfile() method, but the code will be granted

   456         access to restricted versions of the standard I/O streams sys.stdin,

   457         sys.stderr, and sys.stdout.

   458 

   459         """

   460         return self.s_apply(self.r_execfile, args)

   461 

   462     def s_import(self, *args):

   463         """Import a module, raising an ImportError exception if the module

   464         is considered unsafe.

   465 

   466         This method is implicitly called by code executing in the

   467         restricted environment.  Overriding this method in a subclass is

   468         used to change the policies enforced by a restricted environment.

   469 

   470         Similar to the r_import() method, but has access to restricted

   471         versions of the standard I/O streams sys.stdin, sys.stderr, and

   472         sys.stdout.

   473 

   474         """

   475         return self.s_apply(self.r_import, args)

   476 

   477     def s_reload(self, *args):

   478         """Reload the module object, re-parsing and re-initializing it.

   479 

   480         This method is implicitly called by code executing in the

   481         restricted environment.  Overriding this method in a subclass is

   482         used to change the policies enforced by a restricted environment.

   483 

   484         Similar to the r_reload() method, but has access to restricted

   485         versions of the standard I/O streams sys.stdin, sys.stderr, and

   486         sys.stdout.

   487 

   488         """

   489         return self.s_apply(self.r_reload, args)

   490 

   491     def s_unload(self, *args):

   492         """Unload the module.

   493 

   494         Removes it from the restricted environment's sys.modules dictionary.

   495 

   496         This method is implicitly called by code executing in the

   497         restricted environment.  Overriding this method in a subclass is

   498         used to change the policies enforced by a restricted environment.

   499 

   500         Similar to the r_unload() method, but has access to restricted

   501         versions of the standard I/O streams sys.stdin, sys.stderr, and

   502         sys.stdout.

   503 

   504         """

   505         return self.s_apply(self.r_unload, args)

   506 

   507     # Restricted open(...)

   508 

   509     def r_open(self, file, mode='r', buf=-1):

   510         """Method called when open() is called in the restricted environment.

   511 

   512         The arguments are identical to those of the open() function, and a

   513         file object (or a class instance compatible with file objects)

   514         should be returned.  RExec's default behaviour is allow opening

   515         any file for reading, but forbidding any attempt to write a file.

   516 

   517         This method is implicitly called by code executing in the

   518         restricted environment.  Overriding this method in a subclass is

   519         used to change the policies enforced by a restricted environment.

   520 

   521         """

   522         mode = str(mode)

   523         if mode not in ('r', 'rb'):

   524             raise IOError, "can't open files for writing in restricted mode"

   525         return open(file, mode, buf)

   526 

   527     # Restricted version of sys.exc_info()

   528 

   529     def r_exc_info(self):

   530         ty, va, tr = sys.exc_info()

   531         tr = None

   532         return ty, va, tr

   533 

   534 

   535 def test():

   536     import getopt, traceback

   537     opts, args = getopt.getopt(sys.argv[1:], 'vt:')

   538     verbose = 0

   539     trusted = []

   540     for o, a in opts:

   541         if o == '-v':

   542             verbose = verbose+1

   543         if o == '-t':

   544             trusted.append(a)

   545     r = RExec(verbose=verbose)

   546     if trusted:

   547         r.ok_builtin_modules = r.ok_builtin_modules + tuple(trusted)

   548     if args:

   549         r.modules['sys'].argv = args

   550         r.modules['sys'].path.insert(0, os.path.dirname(args[0]))

   551     else:

   552         r.modules['sys'].path.insert(0, "")

   553     fp = sys.stdin

   554     if args and args[0] != '-':

   555         try:

   556             fp = open(args[0])

   557         except IOError, msg:

   558             print "%s: can't open file %r" % (sys.argv[0], args[0])

   559             return 1

   560     if fp.isatty():

   561         try:

   562             import readline

   563         except ImportError:

   564             pass

   565         import code

   566         class RestrictedConsole(code.InteractiveConsole):

   567             def runcode(self, co):

   568                 self.locals['__builtins__'] = r.modules['__builtin__']

   569                 r.s_apply(code.InteractiveConsole.runcode, (self, co))

   570         try:

   571             RestrictedConsole(r.modules['__main__'].__dict__).interact()

   572         except SystemExit, n:

   573             return n

   574     else:

   575         text = fp.read()

   576         fp.close()

   577         c = compile(text, fp.name, 'exec')

   578         try:

   579             r.s_exec(c)

   580         except SystemExit, n:

   581             return n

   582         except:

   583             traceback.print_exc()

   584             return 1

   585 

   586 

   587 if __name__ == '__main__':

   588     sys.exit(test())