Lib/rexec.py

   1 """Restricted execution facilities.
   2
   3 The class RExec exports methods r_exec(), r_eval(), r_execfile(), and
   4 r_import(), which correspond roughly to the built-in operations
   5 exec, eval(), execfile() and import, but executing the code in an
   6 environment that only exposes those built-in operations that are
   7 deemed safe.  To this end, a modest collection of 'fake' modules is
   8 created which mimics the standard modules by the same names.  It is a
   9 policy decision which built-in modules and operations are made
  10 available; this module provides a reasonable default, but derived
  11 classes can change the policies e.g. by overriding or extending class
  12 variables like ok_builtin_modules or methods like make_sys().
  13
  14 XXX To do:
  15 - r_open should allow writing tmp dir
  16 - r_exec etc. with explicit globals/locals? (Use rexec("exec ... in ...")?)
  17
  18 """
  19
  20
  21 import sys
  22 import __builtin__
  23 import os
  24 import ihooks
  25 import imp
  26
  27 __all__ = ["RExec"]
  28
  29 class FileBase:
  30
  31     ok_file_methods = ('fileno', 'flush', 'isatty', 'read', 'readline',
  32             'readlines', 'seek', 'tell', 'write', 'writelines', 'xreadlines',
  33             '__iter__')
  34
  35
  36 class FileWrapper(FileBase):
  37
  38     # XXX This is just like a Bastion -- should use that!
  39
  40     def __init__(self, f):
  41         for m in self.ok_file_methods:
  42             if not hasattr(self, m) and hasattr(f, m):
  43                 setattr(self, m, getattr(f, m))
  44
  45     def close(self):
  46         self.flush()
  47
  48
  49 TEMPLATE = """
  50 def %s(self, *args):
  51         return getattr(self.mod, self.name).%s(*args)
  52 """
  53
  54 class FileDelegate(FileBase):
  55
  56     def __init__(self, mod, name):
  57         self.mod = mod
  58         self.name = name
  59
  60     for m in FileBase.ok_file_methods + ('close',):
  61         exec TEMPLATE % (m, m)
  62
  63
  64 class RHooks(ihooks.Hooks):
  65
  66     def __init__(self, *args):
  67         # Hacks to support both old and new interfaces:
  68         # old interface was RHooks(rexec[, verbose])
  69         # new interface is RHooks([verbose])
  70         verbose = 0
  71         rexec = None
  72         if args and type(args[-1]) == type(0):
  73             verbose = args[-1]
  74             args = args[:-1]
  75         if args and hasattr(args[0], '__class__'):
  76             rexec = args[0]
  77             args = args[1:]
  78         if args:
  79             raise TypeError, "too many arguments"
  80         ihooks.Hooks.__init__(self, verbose)
  81         self.rexec = rexec
  82
  83     def set_rexec(self, rexec):
  84         # Called by RExec instance to complete initialization
  85         self.rexec = rexec
  86
  87     def get_suffixes(self):
  88         return self.rexec.get_suffixes()
  89
  90     def is_builtin(self, name):
  91         return self.rexec.is_builtin(name)
  92
  93     def init_builtin(self, name):
  94         m = __import__(name)
  95         return self.rexec.copy_except(m, ())
  96
  97     def init_frozen(self, name): raise SystemError, "don't use this"
  98     def load_source(self, *args): raise SystemError, "don't use this"
  99     def load_compiled(self, *args): raise SystemError, "don't use this"
 100     def load_package(self, *args): raise SystemError, "don't use this"
 101
 102     def load_dynamic(self, name, filename, file):
 103         return self.rexec.load_dynamic(name, filename, file)
 104
 105     def add_module(self, name):
 106         return self.rexec.add_module(name)
 107
 108     def modules_dict(self):
 109         return self.rexec.modules
 110
 111     def default_path(self):
 112         return self.rexec.modules['sys'].path
 113
 114
 115 # XXX Backwards compatibility
 116 RModuleLoader = ihooks.FancyModuleLoader
 117 RModuleImporter = ihooks.ModuleImporter
 118
 119
 120 class RExec(ihooks._Verbose):
 121     """Basic restricted execution framework.
 122
 123     Code executed in this restricted environment will only have access to
 124     modules and functions that are deemed safe; you can subclass RExec to
 125     add or remove capabilities as desired.
 126
 127     The RExec class can prevent code from performing unsafe operations like
 128     reading or writing disk files, or using TCP/IP sockets.  However, it does
 129     not protect against code using extremely large amounts of memory or
 130     processor time.
 131
 132     """
 133
 134     ok_path = tuple(sys.path)           # That's a policy decision
 135
 136     ok_builtin_modules = ('audioop', 'array', 'binascii',
 137                           'cmath', 'errno', 'imageop',
 138                           'marshal', 'math', 'md5', 'operator',
 139                           'parser', 'select',
 140                           'sha', '_sre', 'strop', 'struct', 'time',
 141                           '_weakref')
 142
 143     ok_posix_names = ('error', 'fstat', 'listdir', 'lstat', 'readlink',
 144                       'stat', 'times', 'uname', 'getpid', 'getppid',
 145                       'getcwd', 'getuid', 'getgid', 'geteuid', 'getegid')
 146
 147     ok_sys_names = ('byteorder', 'copyright', 'exit', 'getdefaultencoding',
 148                     'getrefcount', 'hexversion', 'maxint', 'maxunicode',
 149                     'platform', 'ps1', 'ps2', 'version', 'version_info')
 150
 151     nok_builtin_names = ('open', 'file', 'reload', '__import__')
 152
 153     ok_file_types = (imp.C_EXTENSION, imp.PY_SOURCE)
 154
 155     def __init__(self, hooks = None, verbose = 0):
 156         """Returns an instance of the RExec class.
 157
 158         The hooks parameter is an instance of the RHooks class or a subclass
 159         of it.  If it is omitted or None, the default RHooks class is
 160         instantiated.
 161
 162         Whenever the RExec module searches for a module (even a built-in one)
 163         or reads a module's code, it doesn't actually go out to the file
 164         system itself.  Rather, it calls methods of an RHooks instance that
 165         was passed to or created by its constructor.  (Actually, the RExec
 166         object doesn't make these calls --- they are made by a module loader
 167         object that's part of the RExec object.  This allows another level of
 168         flexibility, which can be useful when changing the mechanics of
 169         import within the restricted environment.)
 170
 171         By providing an alternate RHooks object, we can control the file
 172         system accesses made to import a module, without changing the
 173         actual algorithm that controls the order in which those accesses are
 174         made.  For instance, we could substitute an RHooks object that
 175         passes all filesystem requests to a file server elsewhere, via some
 176         RPC mechanism such as ILU.  Grail's applet loader uses this to support
 177         importing applets from a URL for a directory.
 178
 179         If the verbose parameter is true, additional debugging output may be
 180         sent to standard output.
 181
 182         """
 183
 184         raise RuntimeError, "This code is not secure in Python 2.2 and 2.3"
 185
 186         ihooks._Verbose.__init__(self, verbose)
 187         # XXX There's a circular reference here:
 188         self.hooks = hooks or RHooks(verbose)
 189         self.hooks.set_rexec(self)
 190         self.modules = {}
 191         self.ok_dynamic_modules = self.ok_builtin_modules
 192         list = []
 193         for mname in self.ok_builtin_modules:
 194             if mname in sys.builtin_module_names:
 195                 list.append(mname)
 196         self.ok_builtin_modules = tuple(list)
 197         self.set_trusted_path()
 198         self.make_builtin()
 199         self.make_initial_modules()
 200         # make_sys must be last because it adds the already created
 201         # modules to its builtin_module_names
 202         self.make_sys()
 203         self.loader = RModuleLoader(self.hooks, verbose)
 204         self.importer = RModuleImporter(self.loader, verbose)
 205
 206     def set_trusted_path(self):
 207         # Set the path from which dynamic modules may be loaded.
 208         # Those dynamic modules must also occur in ok_builtin_modules
 209         self.trusted_path = filter(os.path.isabs, sys.path)
 210
 211     def load_dynamic(self, name, filename, file):
 212         if name not in self.ok_dynamic_modules:
 213             raise ImportError, "untrusted dynamic module: %s" % name
 214         if name in sys.modules:
 215             src = sys.modules[name]
 216         else:
 217             src = imp.load_dynamic(name, filename, file)
 218         dst = self.copy_except(src, [])
 219         return dst
 220
 221     def make_initial_modules(self):
 222         self.make_main()
 223         self.make_osname()
 224
 225     # Helpers for RHooks
 226
 227     def get_suffixes(self):
 228         return [item   # (suff, mode, type)
 229                 for item in imp.get_suffixes()
 230                 if item[2] in self.ok_file_types]
 231
 232     def is_builtin(self, mname):
 233         return mname in self.ok_builtin_modules
 234
 235     # The make_* methods create specific built-in modules
 236
 237     def make_builtin(self):
 238         m = self.copy_except(__builtin__, self.nok_builtin_names)
 239         m.__import__ = self.r_import
 240         m.reload = self.r_reload
 241         m.open = m.file = self.r_open
 242
 243     def make_main(self):
 244         m = self.add_module('__main__')
 245
 246     def make_osname(self):
 247         osname = os.name
 248         src = __import__(osname)
 249         dst = self.copy_only(src, self.ok_posix_names)
 250         dst.environ = e = {}
 251         for key, value in os.environ.items():
 252             e[key] = value
 253
 254     def make_sys(self):
 255         m = self.copy_only(sys, self.ok_sys_names)
 256         m.modules = self.modules
 257         m.argv = ['RESTRICTED']
 258         m.path = map(None, self.ok_path)
 259         m.exc_info = self.r_exc_info
 260         m = self.modules['sys']
 261         l = self.modules.keys() + list(self.ok_builtin_modules)
 262         l.sort()
 263         m.builtin_module_names = tuple(l)
 264
 265     # The copy_* methods copy existing modules with some changes
 266
 267     def copy_except(self, src, exceptions):
 268         dst = self.copy_none(src)
 269         for name in dir(src):
 270             setattr(dst, name, getattr(src, name))
 271         for name in exceptions:
 272             try:
 273                 delattr(dst, name)
 274             except AttributeError:
 275                 pass
 276         return dst
 277
 278     def copy_only(self, src, names):
 279         dst = self.copy_none(src)
 280         for name in names:
 281             try:
 282                 value = getattr(src, name)
 283             except AttributeError:
 284                 continue
 285             setattr(dst, name, value)
 286         return dst
 287
 288     def copy_none(self, src):
 289         m = self.add_module(src.__name__)
 290         m.__doc__ = src.__doc__
 291         return m
 292
 293     # Add a module -- return an existing module or create one
 294
 295     def add_module(self, mname):
 296         m = self.modules.get(mname)
 297         if m is None:
 298             self.modules[mname] = m = self.hooks.new_module(mname)
 299         m.__builtins__ = self.modules['__builtin__']
 300         return m
 301
 302     # The r* methods are public interfaces
 303
 304     def r_exec(self, code):
 305         """Execute code within a restricted environment.
 306
 307         The code parameter must either be a string containing one or more
 308         lines of Python code, or a compiled code object, which will be
 309         executed in the restricted environment's __main__ module.
 310
 311         """
 312         m = self.add_module('__main__')
 313         exec code in m.__dict__
 314
 315     def r_eval(self, code):
 316         """Evaluate code within a restricted environment.
 317
 318         The code parameter must either be a string containing a Python
 319         expression, or a compiled code object, which will be evaluated in
 320         the restricted environment's __main__ module.  The value of the
 321         expression or code object will be returned.
 322
 323         """
 324         m = self.add_module('__main__')
 325         return eval(code, m.__dict__)
 326
 327     def r_execfile(self, file):
 328         """Execute the Python code in the file in the restricted
 329         environment's __main__ module.
 330
 331         """
 332         m = self.add_module('__main__')
 333         execfile(file, m.__dict__)
 334
 335     def r_import(self, mname, globals={}, locals={}, fromlist=[]):
 336         """Import a module, raising an ImportError exception if the module
 337         is considered unsafe.
 338
 339         This method is implicitly called by code executing in the
 340         restricted environment.  Overriding this method in a subclass is
 341         used to change the policies enforced by a restricted environment.
 342
 343         """
 344         return self.importer.import_module(mname, globals, locals, fromlist)
 345
 346     def r_reload(self, m):
 347         """Reload the module object, re-parsing and re-initializing it.
 348
 349         This method is implicitly called by code executing in the
 350         restricted environment.  Overriding this method in a subclass is
 351         used to change the policies enforced by a restricted environment.
 352
 353         """
 354         return self.importer.reload(m)
 355
 356     def r_unload(self, m):
 357         """Unload the module.
 358
 359         Removes it from the restricted environment's sys.modules dictionary.
 360
 361         This method is implicitly called by code executing in the
 362         restricted environment.  Overriding this method in a subclass is
 363         used to change the policies enforced by a restricted environment.
 364
 365         """
 366         return self.importer.unload(m)
 367
 368     # The s_* methods are similar but also swap std{in,out,err}
 369
 370     def make_delegate_files(self):
 371         s = self.modules['sys']
 372         self.delegate_stdin = FileDelegate(s, 'stdin')
 373         self.delegate_stdout = FileDelegate(s, 'stdout')
 374         self.delegate_stderr = FileDelegate(s, 'stderr')
 375         self.restricted_stdin = FileWrapper(sys.stdin)
 376         self.restricted_stdout = FileWrapper(sys.stdout)
 377         self.restricted_stderr = FileWrapper(sys.stderr)
 378
 379     def set_files(self):
 380         if not hasattr(self, 'save_stdin'):
 381             self.save_files()
 382         if not hasattr(self, 'delegate_stdin'):
 383             self.make_delegate_files()
 384         s = self.modules['sys']
 385         s.stdin = self.restricted_stdin
 386         s.stdout = self.restricted_stdout
 387         s.stderr = self.restricted_stderr
 388         sys.stdin = self.delegate_stdin
 389         sys.stdout = self.delegate_stdout
 390         sys.stderr = self.delegate_stderr
 391
 392     def reset_files(self):
 393         self.restore_files()
 394         s = self.modules['sys']
 395         self.restricted_stdin = s.stdin
 396         self.restricted_stdout = s.stdout
 397         self.restricted_stderr = s.stderr
 398
 399
 400     def save_files(self):
 401         self.save_stdin = sys.stdin
 402         self.save_stdout = sys.stdout
 403         self.save_stderr = sys.stderr
 404
 405     def restore_files(self):
 406         sys.stdin = self.save_stdin
 407         sys.stdout = self.save_stdout
 408         sys.stderr = self.save_stderr
 409
 410     def s_apply(self, func, args=(), kw={}):
 411         self.save_files()
 412         try:
 413             self.set_files()
 414             r = func(*args, **kw)
 415         finally:
 416             self.restore_files()
 417         return r
 418
 419     def s_exec(self, *args):
 420         """Execute code within a restricted environment.
 421
 422         Similar to the r_exec() method, but the code will be granted access
 423         to restricted versions of the standard I/O streams sys.stdin,
 424         sys.stderr, and sys.stdout.
 425
 426         The code parameter must either be a string containing one or more
 427         lines of Python code, or a compiled code object, which will be
 428         executed in the restricted environment's __main__ module.
 429
 430         """
 431         return self.s_apply(self.r_exec, args)
 432
 433     def s_eval(self, *args):
 434         """Evaluate code within a restricted environment.
 435
 436         Similar to the r_eval() method, but the code will be granted access
 437         to restricted versions of the standard I/O streams sys.stdin,
 438         sys.stderr, and sys.stdout.
 439
 440         The code parameter must either be a string containing a Python
 441         expression, or a compiled code object, which will be evaluated in
 442         the restricted environment's __main__ module.  The value of the
 443         expression or code object will be returned.
 444
 445         """
 446         return self.s_apply(self.r_eval, args)
 447
 448     def s_execfile(self, *args):
 449         """Execute the Python code in the file in the restricted
 450         environment's __main__ module.
 451
 452         Similar to the r_execfile() method, but the code will be granted
 453         access to restricted versions of the standard I/O streams sys.stdin,
 454         sys.stderr, and sys.stdout.
 455
 456         """
 457         return self.s_apply(self.r_execfile, args)
 458
 459     def s_import(self, *args):
 460         """Import a module, raising an ImportError exception if the module
 461         is considered unsafe.
 462
 463         This method is implicitly called by code executing in the
 464         restricted environment.  Overriding this method in a subclass is
 465         used to change the policies enforced by a restricted environment.
 466
 467         Similar to the r_import() method, but has access to restricted
 468         versions of the standard I/O streams sys.stdin, sys.stderr, and
 469         sys.stdout.
 470
 471         """
 472         return self.s_apply(self.r_import, args)
 473
 474     def s_reload(self, *args):
 475         """Reload the module object, re-parsing and re-initializing it.
 476
 477         This method is implicitly called by code executing in the
 478         restricted environment.  Overriding this method in a subclass is
 479         used to change the policies enforced by a restricted environment.
 480
 481         Similar to the r_reload() method, but has access to restricted
 482         versions of the standard I/O streams sys.stdin, sys.stderr, and
 483         sys.stdout.
 484
 485         """
 486         return self.s_apply(self.r_reload, args)
 487
 488     def s_unload(self, *args):
 489         """Unload the module.
 490
 491         Removes it from the restricted environment's sys.modules dictionary.
 492
 493         This method is implicitly called by code executing in the
 494         restricted environment.  Overriding this method in a subclass is
 495         used to change the policies enforced by a restricted environment.
 496
 497         Similar to the r_unload() method, but has access to restricted
 498         versions of the standard I/O streams sys.stdin, sys.stderr, and
 499         sys.stdout.
 500
 501         """
 502         return self.s_apply(self.r_unload, args)
 503
 504     # Restricted open(...)
 505
 506     def r_open(self, file, mode='r', buf=-1):
 507         """Method called when open() is called in the restricted environment.
 508
 509         The arguments are identical to those of the open() function, and a
 510         file object (or a class instance compatible with file objects)
 511         should be returned.  RExec's default behaviour is allow opening
 512         any file for reading, but forbidding any attempt to write a file.
 513
 514         This method is implicitly called by code executing in the
 515         restricted environment.  Overriding this method in a subclass is
 516         used to change the policies enforced by a restricted environment.
 517
 518         """
 519         mode = str(mode)
 520         if mode not in ('r', 'rb'):
 521             raise IOError, "can't open files for writing in restricted mode"
 522         return open(file, mode, buf)
 523
 524     # Restricted version of sys.exc_info()
 525
 526     def r_exc_info(self):
 527         ty, va, tr = sys.exc_info()
 528         tr = None
 529         return ty, va, tr
 530
 531
 532 def test():
 533     import getopt, traceback
 534     opts, args = getopt.getopt(sys.argv[1:], 'vt:')
 535     verbose = 0
 536     trusted = []
 537     for o, a in opts:
 538         if o == '-v':
 539             verbose = verbose+1
 540         if o == '-t':
 541             trusted.append(a)
 542     r = RExec(verbose=verbose)
 543     if trusted:
 544         r.ok_builtin_modules = r.ok_builtin_modules + tuple(trusted)
 545     if args:
 546         r.modules['sys'].argv = args
 547         r.modules['sys'].path.insert(0, os.path.dirname(args[0]))
 548     else:
 549         r.modules['sys'].path.insert(0, "")
 550     fp = sys.stdin
 551     if args and args[0] != '-':
 552         try:
 553             fp = open(args[0])
 554         except IOError, msg:
 555             print "%s: can't open file %r" % (sys.argv[0], args[0])
 556             return 1
 557     if fp.isatty():
 558         try:
 559             import readline
 560         except ImportError:
 561             pass
 562         import code
 563         class RestrictedConsole(code.InteractiveConsole):
 564             def runcode(self, co):
 565                 self.locals['__builtins__'] = r.modules['__builtin__']
 566                 r.s_apply(code.InteractiveConsole.runcode, (self, co))
 567         try:
 568             RestrictedConsole(r.modules['__main__'].__dict__).interact()
 569         except SystemExit, n:
 570             return n
 571     else:
 572         text = fp.read()
 573         fp.close()
 574         c = compile(text, fp.name, 'exec')
 575         try:
 576             r.s_exec(c)
 577         except SystemExit, n:
 578             return n
 579         except:
 580             traceback.print_exc()
 581             return 1
 582
 583
 584 if __name__ == '__main__':
 585     sys.exit(test())