Appdomain 是沙箱 IronPython 的唯一方法吗？
我指的是“Sandbox Ironpython”。
我的要求与原始海报有所不同：
具体来说，我们需要限制不同的功能 - 文件系统访问是可以的，大多数标准 python 模块也可以，但只允许一些显式的 .NET dll（我们想要将 python 脚本限制为我们提供的“官方”API）。 AFAIC，这需要挂钩 python import 语句的实现。
有什么办法可以实现这一点吗？
提前致谢！
I'm referring to "Sandbox Ironpython".
I have somewhat different requirements from the original poster:
Specifically, we need different functionalities to be limited - file system access is okay, most of the standard python modules are also okay, but only a few explicit .NET dlls are to be allowed (we want to restrict the python scripts to the "official" API we provide). AFAICs, this requires to hook into the implementation of the python import statement.
Any way to accomplish this?
Thanks in advance!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
是的，AppDomains 是唯一的方法。如果您通过 .NET 沙箱限制访问，那么您可以使用标准库执行的任何操作也会受到适当限制。那么为什么要费心限制任何 Python 脚本呢？他们不能做任何未经您许可的事情。
Yes, AppDomains are the only way. If you limit access via the .NET sandboxing then anything you could do w/ the standard library would be appropriately limited as well. So why bother restricting any of the Python scripts? They can't do anything you haven't otherwise permitted.
我发布此内容是为了防止其他人像我一样浪费太多时间。
来自 CLR 安全团队的一位高级开发人员对于尝试使用 os.py 时会发生的情况的回应：
“重现示例中的 SecurityException 被抛出，因为 IronPython 中的安全透明代码正在调用 security关键代码 (GCHandle.Free)，这会导致对无限制权限的需求。”
不可能为其提供所需的权限：
“没有一组权限可以累加到 PermissionState.Unrestricted”
即使您可以让它工作，AppDomain 沙箱也是毫无价值的：
“就沙箱不受信任的代码而言，很快，我们将发布新的指南，部分信任不应用作安全边界。完整的指南是：
“.NET Framework 提供了一种机制，可以对同一应用程序中运行的不同代码执行不同级别的信任，称为代码访问安全性 (CAS)。 .NET Framework 中的代码访问安全不应用作部分受信任代码（尤其是来源不明的代码）的安全边界。我们建议不要在没有采取替代安全措施的情况下加载和执行来源不明的代码。”
I'm posting this to prevent others from wasting as much time as I did on this.
From a senior developer on the CLR Security team in response to what happens if you try to use os.py:
"The SecurityException in the repro sample is being thrown because the security transparent code in IronPython is calling security critical code (GCHandle.Free), which leads to a demand for Unrestricted permissions."
It's not possible to give it the permissions it needs:
"there is no set of permissions that adds up to PermissionState.Unrestricted"
Even if you could get it to work, AppDomain sandboxing is worthless:
"As far as sandboxing untrusted code, very soon, we will be releasing new guidance that partial trust should not be used as a security boundary. The guidance in full is:
“The .NET Framework provides a mechanism for the enforcement of varying levels of trust on different code running in the same application called Code Access Security (CAS). Code Access Security in .NET Framework should not be used as a security boundary with partially trusted code, especially code of unknown origin. We advise against loading and executing code of unknown origins without putting alternative security measures in place."