| Title | Sandboxing the tinypy interpreter |
|---|---|
| Student | Denis Kasak |
| Mentor | Philip Hassey |
| Abstract | |
|
tinypy is a minimalistic Python subset implementation. Its small size make it suitable for embedding it in all kinds of restricted environments. By enabling a sandbox mode which would restrict the available resources of the interpreter and protecting the interpreter/VM itself from malicious changes, it could be used for running potentially unsafe code in an isolated environment. This project aims at implementing various resource restrictions and replacing/rewriting functions which could be used in an unsafe manner. The code would also be examined for potential security holes and vulnerabilities. These changes would enable tinypy to safely run any arbitrary Python code. This would also improve tinypy's usefulness in embedded environments (which often have very limited resources) as it would remove the possibility of various Denial-of-Service attacks. The project would make extensive use of test-driven development and unit testing to minimize new bugs and security holes, and also to expose already existing ones. Also, during the course of the project, relevant documentation would be improved to enable future developers to easily extend the sandbox. The secondary goal would be to implement a basic proof-of-concept CPython API to tinypy. This would enable Python programmers to input tinypy as a module, spawn instances of the tinypy interpreter and pass it arbitrary code for execution. The data could then be fetched back to CPython via some secure interface. Finally, the project would follow strongly the requirement of retaining the small size and speed of the interpreter.
|
|