Python code coverage for Lib/rexec.py

#	count	content
1	n/a	"""Restricted execution facilities.
2	n/a
3	n/a	The class RExec exports methods r_exec(), r_eval(), r_execfile(), and
4	n/a	r_import(), which correspond roughly to the built-in operations
5	n/a	exec, eval(), execfile() and import, but executing the code in an
6	n/a	environment that only exposes those built-in operations that are
7	n/a	deemed safe. To this end, a modest collection of 'fake' modules is
8	n/a	created which mimics the standard modules by the same names. It is a
9	n/a	policy decision which built-in modules and operations are made
10	n/a	available; this module provides a reasonable default, but derived
11	n/a	classes can change the policies e.g. by overriding or extending class
12	n/a	variables like ok_builtin_modules or methods like make_sys().
13	n/a
14	n/a	XXX To do:
15	n/a	- r_open should allow writing tmp dir
16	n/a	- r_exec etc. with explicit globals/locals? (Use rexec("exec ... in ...")?)
17	n/a
18	1	"""
19	1	from warnings import warnpy3k
20	1	warnpy3k("the rexec module has been removed in Python 3.0", stacklevel=2)
21	1	del warnpy3k
22	n/a
23	n/a
24	1	import sys
25	1	import __builtin__
26	1	import os
27	1	import ihooks
28	1	import imp
29	n/a
30	1	__all__ = ["RExec"]
31	n/a
32	2	class FileBase:
33	n/a
34	0	ok_file_methods = ('fileno', 'flush', 'isatty', 'read', 'readline',
35	0	'readlines', 'seek', 'tell', 'write', 'writelines', 'xreadlines',
36	1	'__iter__')
37	n/a
38	n/a
39	2	class FileWrapper(FileBase):
40	n/a
41	n/a	# XXX This is just like a Bastion -- should use that!
42	n/a
43	1	def __init__(self, f):
44	0	for m in self.ok_file_methods:
45	0	if not hasattr(self, m) and hasattr(f, m):
46	0	setattr(self, m, getattr(f, m))
47	n/a
48	1	def close(self):
49	0	self.flush()
50	n/a
51	n/a
52	n/a	TEMPLATE = """
53	n/a	def %s(self, *args):
54	n/a	return getattr(self.mod, self.name).%s(*args)
55	1	"""
56	n/a
57	2	class FileDelegate(FileBase):
58	n/a
59	1	def __init__(self, mod, name):
60	0	self.mod = mod
61	0	self.name = name
62	n/a
63	14	for m in FileBase.ok_file_methods + ('close',):
64	13	exec TEMPLATE % (m, m)
65	n/a
66	n/a
67	2	class RHooks(ihooks.Hooks):
68	n/a
69	1	def __init__(self, *args):
70	n/a	# Hacks to support both old and new interfaces:
71	n/a	# old interface was RHooks(rexec[, verbose])
72	n/a	# new interface is RHooks([verbose])
73	0	verbose = 0
74	0	rexec = None
75	0	if args and type(args[-1]) == type(0):
76	0	verbose = args[-1]
77	0	args = args[:-1]
78	0	if args and hasattr(args[0], '__class__'):
79	0	rexec = args[0]
80	0	args = args[1:]
81	0	if args:
82	0	raise TypeError, "too many arguments"
83	0	ihooks.Hooks.__init__(self, verbose)
84	0	self.rexec = rexec
85	n/a
86	1	def set_rexec(self, rexec):
87	n/a	# Called by RExec instance to complete initialization
88	0	self.rexec = rexec
89	n/a
90	1	def get_suffixes(self):
91	0	return self.rexec.get_suffixes()
92	n/a
93	1	def is_builtin(self, name):
94	0	return self.rexec.is_builtin(name)
95	n/a
96	1	def init_builtin(self, name):
97	0	m = __import__(name)
98	0	return self.rexec.copy_except(m, ())
99	n/a
100	1	def init_frozen(self, name): raise SystemError, "don't use this"
101	1	def load_source(self, *args): raise SystemError, "don't use this"
102	1	def load_compiled(self, *args): raise SystemError, "don't use this"
103	1	def load_package(self, *args): raise SystemError, "don't use this"
104	n/a
105	1	def load_dynamic(self, name, filename, file):
106	0	return self.rexec.load_dynamic(name, filename, file)
107	n/a
108	1	def add_module(self, name):
109	0	return self.rexec.add_module(name)
110	n/a
111	1	def modules_dict(self):
112	0	return self.rexec.modules
113	n/a
114	1	def default_path(self):
115	0	return self.rexec.modules['sys'].path
116	n/a
117	n/a
118	n/a	# XXX Backwards compatibility
119	1	RModuleLoader = ihooks.FancyModuleLoader
120	1	RModuleImporter = ihooks.ModuleImporter
121	n/a
122	n/a
123	2	class RExec(ihooks._Verbose):
124	n/a	"""Basic restricted execution framework.
125	n/a
126	n/a	Code executed in this restricted environment will only have access to
127	n/a	modules and functions that are deemed safe; you can subclass RExec to
128	n/a	add or remove capabilities as desired.
129	n/a
130	n/a	The RExec class can prevent code from performing unsafe operations like
131	n/a	reading or writing disk files, or using TCP/IP sockets. However, it does
132	n/a	not protect against code using extremely large amounts of memory or
133	n/a	processor time.
134	n/a
135	1	"""
136	n/a
137	1	ok_path = tuple(sys.path) # That's a policy decision
138	n/a
139	0	ok_builtin_modules = ('audioop', 'array', 'binascii',
140	0	'cmath', 'errno', 'imageop',
141	0	'marshal', 'math', 'md5', 'operator',
142	0	'parser', 'select',
143	0	'sha', '_sre', 'strop', 'struct', 'time',
144	1	'_weakref')
145	n/a
146	0	ok_posix_names = ('error', 'fstat', 'listdir', 'lstat', 'readlink',
147	0	'stat', 'times', 'uname', 'getpid', 'getppid',
148	1	'getcwd', 'getuid', 'getgid', 'geteuid', 'getegid')
149	n/a
150	0	ok_sys_names = ('byteorder', 'copyright', 'exit', 'getdefaultencoding',
151	0	'getrefcount', 'hexversion', 'maxint', 'maxunicode',
152	1	'platform', 'ps1', 'ps2', 'version', 'version_info')
153	n/a
154	1	nok_builtin_names = ('open', 'file', 'reload', '__import__')
155	n/a
156	1	ok_file_types = (imp.C_EXTENSION, imp.PY_SOURCE)
157	n/a
158	1	def __init__(self, hooks = None, verbose = 0):
159	n/a	"""Returns an instance of the RExec class.
160	n/a
161	n/a	The hooks parameter is an instance of the RHooks class or a subclass
162	n/a	of it. If it is omitted or None, the default RHooks class is
163	n/a	instantiated.
164	n/a
165	n/a	Whenever the RExec module searches for a module (even a built-in one)
166	n/a	or reads a module's code, it doesn't actually go out to the file
167	n/a	system itself. Rather, it calls methods of an RHooks instance that
168	n/a	was passed to or created by its constructor. (Actually, the RExec
169	n/a	object doesn't make these calls --- they are made by a module loader
170	n/a	object that's part of the RExec object. This allows another level of
171	n/a	flexibility, which can be useful when changing the mechanics of
172	n/a	import within the restricted environment.)
173	n/a
174	n/a	By providing an alternate RHooks object, we can control the file
175	n/a	system accesses made to import a module, without changing the
176	n/a	actual algorithm that controls the order in which those accesses are
177	n/a	made. For instance, we could substitute an RHooks object that
178	n/a	passes all filesystem requests to a file server elsewhere, via some
179	n/a	RPC mechanism such as ILU. Grail's applet loader uses this to support
180	n/a	importing applets from a URL for a directory.
181	n/a
182	n/a	If the verbose parameter is true, additional debugging output may be
183	n/a	sent to standard output.
184	n/a
185	n/a	"""
186	n/a
187	0	raise RuntimeError, "This code is not secure in Python 2.2 and later"
188	n/a
189	0	ihooks._Verbose.__init__(self, verbose)
190	n/a	# XXX There's a circular reference here:
191	0	self.hooks = hooks or RHooks(verbose)
192	0	self.hooks.set_rexec(self)
193	0	self.modules = {}
194	0	self.ok_dynamic_modules = self.ok_builtin_modules
195	0	list = []
196	0	for mname in self.ok_builtin_modules:
197	0	if mname in sys.builtin_module_names:
198	0	list.append(mname)
199	0	self.ok_builtin_modules = tuple(list)
200	0	self.set_trusted_path()
201	0	self.make_builtin()
202	0	self.make_initial_modules()
203	n/a	# make_sys must be last because it adds the already created
204	n/a	# modules to its builtin_module_names
205	0	self.make_sys()
206	0	self.loader = RModuleLoader(self.hooks, verbose)
207	0	self.importer = RModuleImporter(self.loader, verbose)
208	n/a
209	1	def set_trusted_path(self):
210	n/a	# Set the path from which dynamic modules may be loaded.
211	n/a	# Those dynamic modules must also occur in ok_builtin_modules
212	0	self.trusted_path = filter(os.path.isabs, sys.path)
213	n/a
214	1	def load_dynamic(self, name, filename, file):
215	0	if name not in self.ok_dynamic_modules:
216	0	raise ImportError, "untrusted dynamic module: %s" % name
217	0	if name in sys.modules:
218	0	src = sys.modules[name]
219	n/a	else:
220	0	src = imp.load_dynamic(name, filename, file)
221	0	dst = self.copy_except(src, [])
222	0	return dst
223	n/a
224	1	def make_initial_modules(self):
225	0	self.make_main()
226	0	self.make_osname()
227	n/a
228	n/a	# Helpers for RHooks
229	n/a
230	1	def get_suffixes(self):
231	0	return [item # (suff, mode, type)
232	0	for item in imp.get_suffixes()
233	0	if item[2] in self.ok_file_types]
234	n/a
235	1	def is_builtin(self, mname):
236	0	return mname in self.ok_builtin_modules
237	n/a
238	n/a	# The make_* methods create specific built-in modules
239	n/a
240	1	def make_builtin(self):
241	0	m = self.copy_except(__builtin__, self.nok_builtin_names)
242	0	m.__import__ = self.r_import
243	0	m.reload = self.r_reload
244	0	m.open = m.file = self.r_open
245	n/a
246	1	def make_main(self):
247	0	self.add_module('__main__')
248	n/a
249	1	def make_osname(self):
250	0	osname = os.name
251	0	src = __import__(osname)
252	0	dst = self.copy_only(src, self.ok_posix_names)
253	0	dst.environ = e = {}
254	0	for key, value in os.environ.items():
255	0	e[key] = value
256	n/a
257	1	def make_sys(self):
258	0	m = self.copy_only(sys, self.ok_sys_names)
259	0	m.modules = self.modules
260	0	m.argv = ['RESTRICTED']
261	0	m.path = map(None, self.ok_path)
262	0	m.exc_info = self.r_exc_info
263	0	m = self.modules['sys']
264	0	l = self.modules.keys() + list(self.ok_builtin_modules)
265	0	l.sort()
266	0	m.builtin_module_names = tuple(l)
267	n/a
268	n/a	# The copy_* methods copy existing modules with some changes
269	n/a
270	1	def copy_except(self, src, exceptions):
271	0	dst = self.copy_none(src)
272	0	for name in dir(src):
273	0	setattr(dst, name, getattr(src, name))
274	0	for name in exceptions:
275	0	try:
276	0	delattr(dst, name)
277	0	except AttributeError:
278	0	pass
279	0	return dst
280	n/a
281	1	def copy_only(self, src, names):
282	0	dst = self.copy_none(src)
283	0	for name in names:
284	0	try:
285	0	value = getattr(src, name)
286	0	except AttributeError:
287	0	continue
288	0	setattr(dst, name, value)
289	0	return dst
290	n/a
291	1	def copy_none(self, src):
292	0	m = self.add_module(src.__name__)
293	0	m.__doc__ = src.__doc__
294	0	return m
295	n/a
296	n/a	# Add a module -- return an existing module or create one
297	n/a
298	1	def add_module(self, mname):
299	0	m = self.modules.get(mname)
300	0	if m is None:
301	0	self.modules[mname] = m = self.hooks.new_module(mname)
302	0	m.__builtins__ = self.modules['__builtin__']
303	0	return m
304	n/a
305	n/a	# The r* methods are public interfaces
306	n/a
307	1	def r_exec(self, code):
308	n/a	"""Execute code within a restricted environment.
309	n/a
310	n/a	The code parameter must either be a string containing one or more
311	n/a	lines of Python code, or a compiled code object, which will be
312	n/a	executed in the restricted environment's __main__ module.
313	n/a
314	n/a	"""
315	0	m = self.add_module('__main__')
316	0	exec code in m.__dict__
317	n/a
318	1	def r_eval(self, code):
319	n/a	"""Evaluate code within a restricted environment.
320	n/a
321	n/a	The code parameter must either be a string containing a Python
322	n/a	expression, or a compiled code object, which will be evaluated in
323	n/a	the restricted environment's __main__ module. The value of the
324	n/a	expression or code object will be returned.
325	n/a
326	n/a	"""
327	0	m = self.add_module('__main__')
328	0	return eval(code, m.__dict__)
329	n/a
330	1	def r_execfile(self, file):
331	n/a	"""Execute the Python code in the file in the restricted
332	n/a	environment's __main__ module.
333	n/a
334	n/a	"""
335	0	m = self.add_module('__main__')
336	0	execfile(file, m.__dict__)
337	n/a
338	1	def r_import(self, mname, globals={}, locals={}, fromlist=[]):
339	n/a	"""Import a module, raising an ImportError exception if the module
340	n/a	is considered unsafe.
341	n/a
342	n/a	This method is implicitly called by code executing in the
343	n/a	restricted environment. Overriding this method in a subclass is
344	n/a	used to change the policies enforced by a restricted environment.
345	n/a
346	n/a	"""
347	0	return self.importer.import_module(mname, globals, locals, fromlist)
348	n/a
349	1	def r_reload(self, m):
350	n/a	"""Reload the module object, re-parsing and re-initializing it.
351	n/a
352	n/a	This method is implicitly called by code executing in the
353	n/a	restricted environment. Overriding this method in a subclass is
354	n/a	used to change the policies enforced by a restricted environment.
355	n/a
356	n/a	"""
357	0	return self.importer.reload(m)
358	n/a
359	1	def r_unload(self, m):
360	n/a	"""Unload the module.
361	n/a
362	n/a	Removes it from the restricted environment's sys.modules dictionary.
363	n/a
364	n/a	This method is implicitly called by code executing in the
365	n/a	restricted environment. Overriding this method in a subclass is
366	n/a	used to change the policies enforced by a restricted environment.
367	n/a
368	n/a	"""
369	0	return self.importer.unload(m)
370	n/a
371	n/a	# The s_* methods are similar but also swap std{in,out,err}
372	n/a
373	1	def make_delegate_files(self):
374	0	s = self.modules['sys']
375	0	self.delegate_stdin = FileDelegate(s, 'stdin')
376	0	self.delegate_stdout = FileDelegate(s, 'stdout')
377	0	self.delegate_stderr = FileDelegate(s, 'stderr')
378	0	self.restricted_stdin = FileWrapper(sys.stdin)
379	0	self.restricted_stdout = FileWrapper(sys.stdout)
380	0	self.restricted_stderr = FileWrapper(sys.stderr)
381	n/a
382	1	def set_files(self):
383	0	if not hasattr(self, 'save_stdin'):
384	0	self.save_files()
385	0	if not hasattr(self, 'delegate_stdin'):
386	0	self.make_delegate_files()
387	0	s = self.modules['sys']
388	0	s.stdin = self.restricted_stdin
389	0	s.stdout = self.restricted_stdout
390	0	s.stderr = self.restricted_stderr
391	0	sys.stdin = self.delegate_stdin
392	0	sys.stdout = self.delegate_stdout
393	0	sys.stderr = self.delegate_stderr
394	n/a
395	1	def reset_files(self):
396	0	self.restore_files()
397	0	s = self.modules['sys']
398	0	self.restricted_stdin = s.stdin
399	0	self.restricted_stdout = s.stdout
400	0	self.restricted_stderr = s.stderr
401	n/a
402	n/a
403	1	def save_files(self):
404	0	self.save_stdin = sys.stdin
405	0	self.save_stdout = sys.stdout
406	0	self.save_stderr = sys.stderr
407	n/a
408	1	def restore_files(self):
409	0	sys.stdin = self.save_stdin
410	0	sys.stdout = self.save_stdout
411	0	sys.stderr = self.save_stderr
412	n/a
413	1	def s_apply(self, func, args=(), kw={}):
414	0	self.save_files()
415	0	try:
416	0	self.set_files()
417	0	r = func(args, *kw)
418	n/a	finally:
419	0	self.restore_files()
420	0	return r
421	n/a
422	1	def s_exec(self, *args):
423	n/a	"""Execute code within a restricted environment.
424	n/a
425	n/a	Similar to the r_exec() method, but the code will be granted access
426	n/a	to restricted versions of the standard I/O streams sys.stdin,
427	n/a	sys.stderr, and sys.stdout.
428	n/a
429	n/a	The code parameter must either be a string containing one or more
430	n/a	lines of Python code, or a compiled code object, which will be
431	n/a	executed in the restricted environment's __main__ module.
432	n/a
433	n/a	"""
434	0	return self.s_apply(self.r_exec, args)
435	n/a
436	1	def s_eval(self, *args):
437	n/a	"""Evaluate code within a restricted environment.
438	n/a
439	n/a	Similar to the r_eval() method, but the code will be granted access
440	n/a	to restricted versions of the standard I/O streams sys.stdin,
441	n/a	sys.stderr, and sys.stdout.
442	n/a
443	n/a	The code parameter must either be a string containing a Python
444	n/a	expression, or a compiled code object, which will be evaluated in
445	n/a	the restricted environment's __main__ module. The value of the
446	n/a	expression or code object will be returned.
447	n/a
448	n/a	"""
449	0	return self.s_apply(self.r_eval, args)
450	n/a
451	1	def s_execfile(self, *args):
452	n/a	"""Execute the Python code in the file in the restricted
453	n/a	environment's __main__ module.
454	n/a
455	n/a	Similar to the r_execfile() method, but the code will be granted
456	n/a	access to restricted versions of the standard I/O streams sys.stdin,
457	n/a	sys.stderr, and sys.stdout.
458	n/a
459	n/a	"""
460	0	return self.s_apply(self.r_execfile, args)
461	n/a
462	1	def s_import(self, *args):
463	n/a	"""Import a module, raising an ImportError exception if the module
464	n/a	is considered unsafe.
465	n/a
466	n/a	This method is implicitly called by code executing in the
467	n/a	restricted environment. Overriding this method in a subclass is
468	n/a	used to change the policies enforced by a restricted environment.
469	n/a
470	n/a	Similar to the r_import() method, but has access to restricted
471	n/a	versions of the standard I/O streams sys.stdin, sys.stderr, and
472	n/a	sys.stdout.
473	n/a
474	n/a	"""
475	0	return self.s_apply(self.r_import, args)
476	n/a
477	1	def s_reload(self, *args):
478	n/a	"""Reload the module object, re-parsing and re-initializing it.
479	n/a
480	n/a	This method is implicitly called by code executing in the
481	n/a	restricted environment. Overriding this method in a subclass is
482	n/a	used to change the policies enforced by a restricted environment.
483	n/a
484	n/a	Similar to the r_reload() method, but has access to restricted
485	n/a	versions of the standard I/O streams sys.stdin, sys.stderr, and
486	n/a	sys.stdout.
487	n/a
488	n/a	"""
489	0	return self.s_apply(self.r_reload, args)
490	n/a
491	1	def s_unload(self, *args):
492	n/a	"""Unload the module.
493	n/a
494	n/a	Removes it from the restricted environment's sys.modules dictionary.
495	n/a
496	n/a	This method is implicitly called by code executing in the
497	n/a	restricted environment. Overriding this method in a subclass is
498	n/a	used to change the policies enforced by a restricted environment.
499	n/a
500	n/a	Similar to the r_unload() method, but has access to restricted
501	n/a	versions of the standard I/O streams sys.stdin, sys.stderr, and
502	n/a	sys.stdout.
503	n/a
504	n/a	"""
505	0	return self.s_apply(self.r_unload, args)
506	n/a
507	n/a	# Restricted open(...)
508	n/a
509	1	def r_open(self, file, mode='r', buf=-1):
510	n/a	"""Method called when open() is called in the restricted environment.
511	n/a
512	n/a	The arguments are identical to those of the open() function, and a
513	n/a	file object (or a class instance compatible with file objects)
514	n/a	should be returned. RExec's default behaviour is allow opening
515	n/a	any file for reading, but forbidding any attempt to write a file.
516	n/a
517	n/a	This method is implicitly called by code executing in the
518	n/a	restricted environment. Overriding this method in a subclass is
519	n/a	used to change the policies enforced by a restricted environment.
520	n/a
521	n/a	"""
522	0	mode = str(mode)
523	0	if mode not in ('r', 'rb'):
524	0	raise IOError, "can't open files for writing in restricted mode"
525	0	return open(file, mode, buf)
526	n/a
527	n/a	# Restricted version of sys.exc_info()
528	n/a
529	1	def r_exc_info(self):
530	0	ty, va, tr = sys.exc_info()
531	0	tr = None
532	0	return ty, va, tr
533	n/a
534	n/a
535	1	def test():
536	0	import getopt, traceback
537	0	opts, args = getopt.getopt(sys.argv[1:], 'vt:')
538	0	verbose = 0
539	0	trusted = []
540	0	for o, a in opts:
541	0	if o == '-v':
542	0	verbose = verbose+1
543	0	if o == '-t':
544	0	trusted.append(a)
545	0	r = RExec(verbose=verbose)
546	0	if trusted:
547	0	r.ok_builtin_modules = r.ok_builtin_modules + tuple(trusted)
548	0	if args:
549	0	r.modules['sys'].argv = args
550	0	r.modules['sys'].path.insert(0, os.path.dirname(args[0]))
551	n/a	else:
552	0	r.modules['sys'].path.insert(0, "")
553	0	fp = sys.stdin
554	0	if args and args[0] != '-':
555	0	try:
556	0	fp = open(args[0])
557	0	except IOError, msg:
558	0	print "%s: can't open file %r" % (sys.argv[0], args[0])
559	0	return 1
560	0	if fp.isatty():
561	0	try:
562	0	import readline
563	0	except ImportError:
564	0	pass
565	0	import code
566	0	class RestrictedConsole(code.InteractiveConsole):
567	0	def runcode(self, co):
568	0	self.locals['__builtins__'] = r.modules['__builtin__']
569	0	r.s_apply(code.InteractiveConsole.runcode, (self, co))
570	0	try:
571	0	RestrictedConsole(r.modules['__main__'].__dict__).interact()
572	0	except SystemExit, n:
573	0	return n
574	n/a	else:
575	0	text = fp.read()
576	0	fp.close()
577	0	c = compile(text, fp.name, 'exec')
578	0	try:
579	0	r.s_exec(c)
580	0	except SystemExit, n:
581	0	return n
582	0	except:
583	0	traceback.print_exc()
584	0	return 1
585	n/a
586	n/a
587	1	if __name__ == '__main__':
588	0	sys.exit(test())