securing (perl) legacy programs for web service provision (apache)

Question

I have a long old legacy perl program on linux, written in the old days for a set of trusted local users. It was not written with security in mind.

We want to resurrect it to take input and provide output as a service over the web. It needs to read cgi in, pass it to this old legacy program, and return the answer to the client browser. alas, we do not have the manpower to audit old perl programs for man-months. (Perl has some sandboxing features that can be wrapped around eval's, but this seems fragile.)

what are good options here?

• run a virtual machine that runs a distribution that is designed to be read-only on root, and keeps everything very separate on /var/ only. (which one? ubuntu flavor?)

• run a virtual machine that we wipe periodically.

this is all on linux---I know how to run vmware for my windows VM, but this does not seem to be the best tool. I tried kvm 2 years ago, but it had a steep learning curve then. it would seem I almost want to run

 $ make-iso / > my.iso
 $ exec.vm my.iso --mount '/var = my.vdisk' --run '/var/my.program'

• our legacy program could conceivably be altered to read in all its necessary input files early on, and then could only operate on stdin/stdout. if an OS had a kernel call that we could call to disconnect all later process and subprocess access to all disk filesystems, then this legacy program would become safe, even if someone had originally inserted malicious code somewhere late and or called a system exec. I don't think this is possible in linux, bsd, or some other unix like OS. (PS: how sad that such an easy way to secure programs does not exist. :-( .)

this is probably a common problem. what is a good way to handle it?

/iaw

Answer 1

There are no good solutions for this problem. Security is hard.

An alternative to running it in a full VM would be to use Linux Containers.

Docker is a very easy way to manage containers and in this case I would simply fire up a new container for each run of the script and blow it away after the container was run.

https://www.docker.io/