我目前正在使用沙盒 PyPy 编写一个 Python 沙盒。基本上，沙箱的工作原理是提供一个“控制器”，将系统库调用映射到指定的函数。按照 codespeak 中的说明进行操作后（逐步完成设置过程） ），我意识到默认控制器不包含 os.fstat() 的替代品，因此当我调用 open() 时会崩溃。具体来说，包含的 pypy/translator/sandbox/sandlib.py 不包含 do_ll_os__ll_os_fstat 的定义。
到目前为止，我已经将其实现为：
def do_ll_os__ll_os_fstat(self, fd):
return os.fstat(fd)
看起来效果很好。这安全吗？这会在沙箱中造成一个洞吗？
I'm currently writing a Python sandbox using sandboxed PyPy. Basically, the sandbox works by providing a "controller" that maps system library calls to a specified function instead. After following the instructions found at codespeak (which walk through the set up process), I realized that the default controller does not include a replacement for os.fstat(), and therefore crashes when I call open(). Specifically, the included pypy/translator/sandbox/sandlib.py does not contain a definition for do_ll_os__ll_os_fstat.
So far, I've implemented it as:
def do_ll_os__ll_os_fstat(self, fd):
return os.fstat(fd)
which seems to work fine. Is this safe? Will this create a hole in the sandbox?
发布评论
评论（2）
fstat 调用可能会泄露您可能想要或不想保密的某些信息。除此之外：
但是，它不会修改任何内容，所以如果您不介意这一点（相对较小）信息泄露，没问题。您还可以更改某些结果以掩盖您想要隐藏的信息（例如，将所有者 UID/GID 设置为 0）
The fstat call can reveal certain information which you may or may not want to keep secret. Among other things:
However, it will not modify anything, so if you don't mind this (relatively minor) information leak, no problem. You could also alter some of the results to mask information you want to hide (set owner UIDs/GIDs to 0, for example)
bdonlan 的答案很好，但是既然这里有赏金，那又怎么样 :-)
您可以通过阅读 fstat 提供的信息。 opengroup.org/onlinepubs/9699919799/basedefs/sys_stat.h.html" rel="nofollow">struct stat 的 POSIX 规范。
这绝对是一个“只读”操作。通常，Unix 文件描述符仅提供对其引用的单个对象的访问。例如，引用目录的（可读）文件描述符将允许您列出该目录中的文件，但不允许您访问该目录中的文件；为此，您需要
open()该文件，这将执行权限检查。请注意，
fstat可以在非文件（例如目录或套接字）上调用。不过，这里它只会提供您在 struct stat 中看到的信息，并且不会修改任何内容。 （对于套接字，大多数字段将毫无意义。）bdonlan's answer is good, but since there is a bounty here, what the heck :-)
You can see for yourself precisely what information
fstatprovides by reading the POSIX spec for struct stat.It is definitely a "read-only" operation. And as a rule, Unix file descriptors only provide access to the single object to which they refer. For example, a (readable) file descriptor referencing a directory will allow you to list the files within the directory, but it will not allow you to access files within the directory; for that, you need to
open()the file, which will perform a permission check.Be aware that
fstatcan be called on non-files like directories or sockets. Here again, though, it will only provide the information you see instruct statand it will not modify anything. (And for a socket, most of the fields will be meaningless.)