锁定程序，使其无法访问外部文件，就像病毒扫描程序一样
我想以编程方式启动一个不受信任的应用程序，因此我想删除该程序访问文件、网络等的能力。本质上，我想限制它，使其与计算机其余部分的唯一接口是标准输入和标准输出。
我可以这样做吗？最好以跨平台的方式，但我希望对每个操作系统都采取不同的做法。我正在使用Python，但如果有必要，我愿意用较低级别或更平台集成的语言编写这部分。
我需要这样做的原因是编写一个分布式计算基础设施。它需要下载一个程序，执行它，将数据传输到标准输入，并将在标准输出上接收到的数据返回到中央服务器。但由于它下载的程序不受信任，我想将其限制为仅使用标准输入和标准输出。
I would like to launch an untrusted application programmatically, so I want to remove the program's ability to access files, network, etc. Essentially, I want to restrict it so its only interface to the rest of the computer is stdin and stdout.
Can I do that? Preferably in a cross-platform way but I sort of expect to have to do it differently for each OS. I'm using Python, but I'm willing to write this part in a lower level or more platform integrated language if necessary.
The reason I need to do this is to write a distributed computing infrastructure. It needs to download a program, execute it, piping data to stdin, and returning data that it receives on stdout to the central server. But since the program it downloads is untrusted, I want to restrict it to only using stdin and stdout.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
是的，你可以这样做。您可以通过 ptrace 运行一个较差的进程（本质上您充当调试器）并挂钩系统调用并确定是否允许它们。
例如，codepad.org 就是这样做的，请参阅：关于 codepad。它使用 geordi 管理程序来执行不受信任的代码。
Yes, you can do this. You can run an inferior process through ptrace (essentially you act as a debugger) and you hook on system calls and determine whether they should be allowed or not.
codepad.org does this for instance, see: about codepad. It uses the geordi supervisor to execute the untrusted code.
您可以在 chroot 中运行不受信任的应用程序，并通过 iptables 规则阻止它们使用网络（例如，所有者 --uid-owner 匹配）。
但实际上，虚拟机更可靠，并且对现代硬件性能的影响可以忽略不计。
You can run untrusted apps in chroot and block them from using network with an iptables rule (for example, owner --uid-owner match)
But really, virtual machine is more reliable and on modern hardware performance impact is negligible.
简短的回答是否定的。
长答案并不是真的。考虑一个 C 程序，其中程序通过抓取下一个可用的文件描述符来打开日志文件。为了阻止这种情况，您的程序需要以某种方式监视并阻止它。根据不受信任程序的稳健性，这可能会导致致命的崩溃，或抑制无害的功能。还有许多其他类似的问题使您想要做的事情变得困难。
我建议查看现有的沙箱解决方案。特别是，虚拟机对于测试不受信任的代码非常有用。如果你找不到任何满足你需求的东西，你最好的选择可能是在内核级别处理这个问题，或者使用更接近硬件的东西，比如 C。
The short answer is no.
The long answer is not really. Consider a C program, in which the program opens a log file by grabbing the next available file descriptor. Your program, in order to stop this, would need to somehow monitor this, and block it. Depending on the robustness of the untrusted program, this could cause a fatal crash, or inhibit harmless functionality. There are many other similar issues to this one that make what you are trying to do hard.
I would recommend looking into sandboxing solutions already available. In particular, a virtual machine can be very useful for testing out untrusted code. If you can't find anything that meets your needs, your best bet is to probably deal with this at the kernel level, or with something a bit closer to the hardware such as C.