CODEWITHSUNDEEP
pythonsecuritymodule
user975135
user975135

Reputation:

Python modding - prevent dangerous scripts to be imported?

I want to allow users to make their own Python "mods" for my game, by placing their scripts in a special folder which the game "scans" for Python modules and imports. What would be the simplest way to prevent "dangerous" scripts from being imported? I don't want people complaining to me that they used someone's mod and it erased their hard drive. Things I would like to limit is accessing/modifying/creating any files outside of their folder and connecting to the internet/downloading/sending data. If you can thik of anything else, let me know.

So how can this be done?

Upvotes: 4

Views: 998

Answers (4)

sleeplessnerd
sleeplessnerd

Reputation: 22761

Restricted Python seems to able to restrict functionality for code in a clean way and is compatible with python up to 2.7.

http://pypi.python.org/pypi/RestrictedPython/

e.g.

By supplying a different __builtins__ dictionary, we can rule out unsafe operations, such as opening files [...]

Upvotes: 2

alexis
alexis

Reputation: 50200

Giving them python execution and trying to limit what they do is asking for trouble. See this SO question for discussion and a pointer to a good article. (You would presumably disable "eval", but it wouldn't make much difference in practice.

My suggestion: Turn the question around. Your goal is to provide them with scripting facilities so they can enhance the game. Find or define an interpreter for a suitable scripting language that has the features you need, and use it to execute their scripts. For example, you could support data persistence in a simple keystore model, without giving them file creation access. Or give them a command to create files but ensure it only accepts a path-less filename. The essential thing is to ensure that there is NO way for them to execute python commands directly.

Upvotes: 0

SingleNegationElimination
SingleNegationElimination

Reputation: 156168

There are some serious shortcomings for sandboxed python execution. aquavitae's answer links to some good discussion on the matter, especially this blog post. Read that first.

There is a kernel of secure execution within cPython. The fundamental idea is to replace the __builtins__ global (Note: not the __builtin__ module), which informs python to turn on some security features; making a handful of attributes on certain objects inaccessible, and removing most of the implementation objects from the interpreter when evaulating that bit of code.

You'll then need to write an actual implementation; in such a way that the protected modules are not the leaked into the sandbox. A fairly tested "file" replacement is provided in the linked blog. Getting a look on that might give you an idea of how involved and complex this problem is.

So now that you have understood that this is a challenge in python; you should take a look at languages with sandbox execution as a core feature, such as Lua, which is very popular in games.

Upvotes: 0

aquavitae
aquavitae

Reputation: 19114

The obvious way to do it is to load the module as a string and exec it. This has just as many security risks, but might be easier to block by using custom globals and locals. Have a look at this question - it gives some really good guidance on this. As pointed out in Delnan's comments, this isn't completely secure though.

You could also try this. I haven't used it, but it seems to provide a safe environment for unsafe scripts.

Upvotes: 0

Related Questions