jython-dev

[Jython-dev] Safe Jython?

[M. R. <mr...@ni...>]

Hello!

Can I restrict an imbedded jython interpreter in the same fashion
that I can restrict an imbedded python interpreter. Do I have
to resort to the java.security properties to do this? If there is a
better way, I would appreciate a tip on how to proceed.


Is there some way to restrict loop execution in a jython program
to a maximum number of iterations?


Thanks in advance.

Ranga.

-- 
M. Ranganathan
Advanced Networking Technologies Divsion
National Institute of Standards and Technology (NIST)
100 Bureau Drive, Stop 8920, Gaithersburg, MD 20899.
Tel: 301 975 3664 ; Fax: 301 590 0932

Advanced Networking Technologies For the People!

Re: [Jython-dev] Safe Jython?

[<bc...@wo...>]

[M. Ranganathan]

>Can I restrict an imbedded jython interpreter in the same fashion
>that I can restrict an imbedded python interpreter. Do I have
>to resort to the java.security properties to do this? If there is a
>better way, I would appreciate a tip on how to proceed.

The best way (IMO) is to use a security manager. Simply because the java
security manager feature have been put through more testing and review
than any similar feature we could add to jython.

>Is there some way to restrict loop execution in a jython program
>to a maximum number of iterations?

Generally no. Maybe the trace hooks:

  http://www.python.org/doc/current/lib/module-sys.html#l2h-250

can be abused for this purpose, but I'm sure an evil program can also
defeat that.

Security (in any form) was never in the design spec for jython. Because
of that, jython will never (IMO) be a secure environment.

regards,
finn

Re: [Jython-dev] Safe Jython?

[Jeremy H. <je...@zo...>]

>>>>> "FB" == Finn Bock <bc...@wo...> writes:

  FB> [M. Ranganathan]
  >> Can I restrict an imbedded jython interpreter in the same fashion
  >> that I can restrict an imbedded python interpreter. Do I have to
  >> resort to the java.security properties to do this? If there is a
  >> better way, I would appreciate a tip on how to proceed.

  FB> The best way (IMO) is to use a security manager. Simply because
  FB> the java security manager feature have been put through more
  FB> testing and review than any similar feature we could add to
  FB> jython.

One limitation of this approach is that you can't restrict access to
anything written in Python.  One of the chief limitations of Python for
security is that you don't have any access controls on instances.  A
private name (__name) is just as accessible as any other name.  Adding
some coarse access controls if one of the features of rexec.

I suppose you could write a generic wrapper object in Java and use it
to wrap Python objects.

Jeremy