How to create a sandbox for newLisp?

[ale870]

Hello,



is there any way to eliminate (or disable) some I/O functions from newLisp?



I wish to embed newLisp scripts inside some files downloaded from internet: imagine when you download an HTML page from internet, which contains Javascript. Well i want to create some specific pages containing newLisp code (to be executed on a local computer), but I I need to eliminate the possibility that someone may write some "dangerous" newLisp code. So I use newLisp as library, but I need to disable functions regarding read/write files, sockets, etc...



Is it possible? Can I use a trick?

Thank you for your help!



EDIT:

If I "erase" all "dangerous" functions using "constant" function

E.g.:

(constant 'write-file nil)



Is there any way, for an attacker, to restore the original value, or to write another, similar function to achieve the same behaviour? In practice, is there any way to write a function to read/write files without using the functions (write-file)?



Thank you

[newdep]

If you want to sandbox (limit access outside newlisp) you could think of using a FUSE way perhpas...

(seek for Filesystem in User Space)



But just to slimmdown newlisp... have a looks here: (where cormulion quotes me my old code ;-))

http://newlispfanclub.alh.net/forum/viewtopic.php?f=9&t=3843">//http://newlispfanclub.alh.net/forum/viewtopic.php?f=9&t=3843



Old topic already but works fine, just make sure to check all functions again before pushing it into to real world..  ;-)



Another way is to create a "slimlined" newlisp version where you have disabled functions during compile time.

This is thow not inline with any commercial use of newlisp as you adjust the source code.





Regarding read/writeing file... you could still use the "device" option inside newlisp OR go into "filter" mode where newlisp becomes a CGI portal...(see the cgi http exmaple in the docs...)



hope this covers the question ;-)

[ale870]

Yes, I understood that it is a mess!

Thank you, I'm reading about FUSE.



I didn't understand the topic related to cormullion.



THank you again!

[Lutz]

Here is a different version of the sandbox program online:



http://www.newlisp.org/syntax.cgi?code/sandbox.txt">http://www.newlisp.org/syntax.cgi?code/sandbox.txt

[ale870]

Very nice, thank you!

One question: can someone (using a trick) "restore" a function inside a "safe" session?



For example, in a newLisp session I set this:

(constant 'write-line "Error")



Well, can someone, in that session, restore the original write-line behavior?

Is yes, how?



Thank you!

[Lutz]

I don't think restoring the disabled functions is possible.



You would have to know the original address of the built-in function and also have the ability to change the type and auxiliary fields in a newLISP cell. The function address is different on each platform and version of newLISP. In order to change the type and auxiliary fields, the critical tool is the built-in 'cpymem', which is also disabled.



See also here:



http://www.newlisp.org/index.cgi?page=Embedded_Binary">http://www.newlisp.org/index.cgi?page=Embedded_Binary



But I also think that a better idea is, to run newLISP in some sort of virtual OS environment with limited resources. This way you can give the user a full functioning newLISP.

[TedWalther]

If your customer is using OpenBSD, you can do exactly what you want using "systrace".  You can create "profile" for your application.  The OS will control what system calls your application can access; it can even allow system calls with certain arguments to succeed, but deny others.  It controls file system access, network access, etc.  It is very flexible and nice.  Is it cross-platform?  No.  But it works.

[TedWalther]

Systrace is distributed under a BSD-style license and has been integrated into NetBSD, OpenBSD and OpenDarwin. NetBSD-current contains the most recent Systrace source code. You can use AnonCVS to access it. At the moment, systrace supports native and Linux binaries.

Ports



    GNU/Linux port is finished and kernel patch is maintained actively by Marius Eriksen. Can be run without kernel changes using the ptrace backend.

    Mac OS X port is almost complete; currently unmaintained due to lack of hardware.

    FreeBSD port by Rich Murphey; in progress.

[ale870]

systrace could be fine, but it is not cross-platform, and I miss one of the most important OS: Windows (I don't like it, but is "famous" and the most used).



I think the best idea is still remapping native newLisp functions, disabling even cpymem and similar.

For me, cross platform, is a key-feature.