Sandboxing from Lua

[bopjesvla]

Is this a safe way to sandbox luerl?

-- called with luerl:do

whitelist = {
  _G = _G,
  ipairs = ipairs,
  next = next,
  pairs = pairs,
  pcall = pcall,
  tonumber = tonumber,
  tostring = tostring,
  type = type,
  unpack = unpack,
  string = { byte = string.byte, char = string.char, find = string.find, 
      format = string.format, gmatch = string.gmatch, gsub = string.gsub, 
      len = string.len, lower = string.lower, match = string.match, 
      rep = string.rep, reverse = string.reverse, sub = string.sub, 
      upper = string.upper },
  table = { insert = table.insert, maxn = table.maxn, remove = table.remove, 
      sort = table.sort }
}

for i in pairs(_G) do
  if not whitelist[i] then
    _G[i] = "prohibited in sandbox"
  else
    _G[i] = whitelist[i]
  end
end

[bopjesvla]

The code is based on http://stackoverflow.com/a/6982080/678335, by the way. I'm somewhat confident there is no way around this, but I'd rather be safe than sorry.

[rvirding]

That would work. It also depends on how you start luerl. Another way could be start doing the same thing from within the luerl module after you have created the initial state but before you start running luerl. That would be guaranteed safer as it is done before any lua code is run. You would basically do it the same way.

[bopjesvla]

That's good to know!

[tisba]

Would it make sense to add this to the README, wiki or maybe even offer an API to initialise an environment based on that out of the box?

[lastcanal]

Hi @tisba, sandbox functionality is available through the luerl_sandbox module that is included along with luerl. Take a look at these examples to see it in action. The actual implementation does something similar to the Lua script above, but in Erlang; essentially what Robert describes in his comment. It also includes a reduction counting 'runner' to prevent 'fork bomb' style scripts from crashing the VM.

Take a look at PR #85 for more info.

[tisba]

Damn, I totally overlooked this. Sorry for the noise, and thanks! 👍