From: Caleb Clausen <vikkous@...>
Date: 2010-05-23T21:43:05+09:00
Subject: Re: Eval, SAFE, and Sandbox

On 5/21/10, Simon Mcbryan <smcbryan@gmail.com> wrote:
> Hello Ruby Forum.
>
> I am working on a personal project that will need people to be able to
> submit bits of Ruby code so that my project can run it (eval).  I know
> there is a lot of danger in this and wonder if there are any solid ways
> to avoid malicious attacks.
>
> From what I have read and seen on Google, there is the $SAFE (=4)
> variable which is supposed to prevent many vulnerabilities, but at the
> same time, there are many sources saying this is not reliable.  Also, I
> have seen that a year or 2 ago, there was a popular Ruby project called
> Sandbox, created by a whytheluckystiff, who has apparently disappeared
> off the face of the planet, and thus killing the project.
>
> So I am wondering if I should attempt to work off Sandbox, although I
> don't think it is maintained or updated to the newer Ruby versions
> (1.8.7+).  I am pretty new to the whole metaprogramming world, so I am
> not sure if I could handle this either.  Or should I try to create my
> own system, using $SAFE, disallowing known loopholes, running in a
> thread with a kill time and timeout limit, etc.  Or is there an
> alternative to Sandbox that I should be looking at that my research has
> not turned up?  Thanks for your time.

$SAFE is unlikely to be good enough. Even why's sandbox probably has
some vulnerabilities.

Depending on what you're doing, you could try running inside a virtual
machine or freebsd jail. These are general-purpose sandbox facilities,
not ruby specific. That's somewhat difficult to set up, but they
should be very solid choices.

All these ideas could be combined. That is, you run with $SAFE=4, in
why's sandbox, inside a jail in a freebsd installation running in a
virtual machine. That way, you have multiple layers of protection, and
the best of all worlds.

Another idea; if you want to use jruby, you could take advantage of
the jvm's sandboxing capabilities. I believe this would require some
custom java security manager programming.