Built-in security subsystem

[TIGirardi (Tiago Illipronti Girardi)]

From my point of view, you are not describing anything specific. You are just posting an abstract wish list and stating that it should be doable without providing any specifics on how.

One core dev said that it was already tried, unsuccessfully, and that the core devs stopped trying. He also said that to change their minds you would need to provide an implementation.

Another person linked to a message from a core dev stating the very specific reasons he now believes it to be impossible. In that message, he says that the best way to secure Python is to run it in an external sandbox.

It is my understanding that using an external sandbox would fulfill your wish list, with the added benefit of not requiring work the core dev team. Why should they work on a solved problem?

[mwr]

@abessman

Successful idea proposals work the other way around: You do the work to demonstrate that your idea is sound (including at the very least a proof-of-concept implementation). Only then can you expect others to take you seriously.

Similar disputes have already been in the previous topic. Well, if you think so then it’s your right. I’m interested in discussing something else entirely.
In any case, it is surprising that the event monitoring subsystem appeared at all. And now it’s clear why its immediate developers don’t want to discuss it. After all, in the opinion of many, it should not have been at all.

@abessman

The onus is on you to make the case for your idea(s), not on others to make the case against them.

So I’m in favor of it myself. And so far, I’m giving specific counterarguments to all specific arguments.
But they tell me, no, it’s not enough, give us a ready-made implementation, and then maybe we’ll discuss it. Maybe

[TIGirardi (Tiago Illipronti Girardi)]

@mwr

it is surprising that the event monitoring subsystem appeared at all

Why, and more important how, do you think the monitoring subsystem would help you? Be specific and I’m sure people are going to be more specific in their replies.

[TIGirardi (Tiago Illipronti Girardi)]

@mwr

I’m giving specific counterarguments to all specific arguments

Not in this thread and not in the old one you were specific enough to warrant any specific response.

[mwr]

@TIGirardi

From my point of view, you are not describing anything specific. You are just posting an abstract wish list and stating that it should be doable without providing any specifics on how.

This is the ideas section. Where did I say that something should be implemented?

@TIGirardi

One core dev said that it was already tried, unsuccessfully, and that the core devs stopped trying.

No, it just said that past attempts were just unsuccessful. Regardless of their details. Namely, the details are important in the context of my specific ideas. Yes, they don’t have an implementation yet, but so go through the other topics in the subsection. People also discuss unrealized things.

@TIGirardi

Another person linked to a message from a core dev stating the very specific reasons he now believes it to be impossible.

But there are also my specific counterarguments on this list from ten years ago. I suggest we discuss them anyway

@TIGirardi

Why should they work on a solved problem?

I didn’t say anything like that. You came up with this statement yourself.
Moreover, in the original message, I also made a footnote about this, anticipating such attempts to attribute it to me.

[abessman (Alexander Bessman)]

@mwr

it is surprising that the event monitoring subsystem appeared at all.

Not at all; it was made because someone put in the work to make it.

@mwr

in the opinion of many, it should not have been at all.

No one has said this. It is entirely your own, incorrect, conclusion.

[mwr]

@TIGirardi

Why

Okay, you’re blurting out the subject. And then they will say again that there is no specifics and the topic should be closed.
There are specific arguments above and my specific counterarguments with examples. If you really want to discuss, you will discuss them.

Built-in security subsystem

But it was since then that the event audit system appeared. As for Victor’s arguments, could you put them together in a structured list like mine so that we can discuss them on the merits? I have identified the following for myself: It seemed to me that this was the main reasoned remark there. But it’s strange to hear about such a problem, if in the future it’s possible to create readonly modules then it’s solved simply globals()[__builtins __] = ModuleProxy(__builtins __) Or let other w…

Built-in security subsystem

It’s just strange that so far none of the core developers have allowed themselves to say this Probably because something like this has already been implemented through MappingProxy class A: pass A.__dict__ = { "a": "a" } # AttributeError: attribute '__dict__' of 'type' objects is not writable A.__dict__["a"] = "a" # TypeError: 'mappingproxy' object does not support item assignment And even if it’s not easy to transfer this implementation to all other python objects, it’s quite feasibl…

@abessman

it was made because someone put in the work to make it

And there were even quite a few preliminary discussions about this
But yes, Guido was also involved in those discussions.
Unfortunately, those days are over.

@abessman

No one has said this. It is entirely your own, incorrect, conclusion.

So be it. There is a discussion above, where everyone can see who said what.
And I’ve already talked enough in general terms about nothing. There are discussion threads above where specific things and issues are discussed.
Anyone who really wants to discuss the issue will discuss it there, and not pour it from empty to empty.

[devdanzin (Daniel Diniz)]

As someone who has followed many such “securing Python” initiatives (and even found exploitable issues in a couple), I’d like to ask you to ponder whether you find this idea completely feasible out of an abundance or a lack of information.

If the former, please share more details about how it could be made to work, because the community and core devs do not believe it to be sound so far. If the latter, please read not only about other such proposals (and especially how they fail), but also about how “creating readonly anything” in Python has failed in many ways.

Regarding specifics and immutable objects, please read There is a way to access an underlying mapping in MappingProxyType · Issue #88004 · python/cpython · GitHub. Is it enough for you to believe not even MappingProxy is safe from Python’s mutability shenanigans?

Regarding the audit hooks as a security feature, I’ll quote the docs:

Note that audit hooks are primarily for collecting information about internal or otherwise unobservable actions, whether by Python or libraries written in Python. They are not suitable for implementing a “sandbox”. In particular, malicious code can trivially disable or bypass hooks added using this function. At a minimum, any security-sensitive hooks must be added using the C API PySys_AddAuditHook() before initialising the runtime, and any modules allowing arbitrary memory modification (such as ctypes) should be completely removed or closely monitored.

Also, some expected audit hooks are missing, finding similar issues would offer exploit opportunities to breaking your proposed security system:

Missing audit hooks in several extension modules

So you’d be talking about plugging holes and disabling insecure features… which has been shown not to work in general, using a feature that is explicitly listed as not suitable for security.

Even currently maintained projects like RestrictedPython, which removes all sorts of dangerous constructs and features (leaving a very limited Python that isn’t that useful), face their share of security escapes.

I hope this helps.

[mwr]

@devdanzin

If the latter, please read not only about other such proposals (and especially how they fail), but also about how “creating readonly anything” in Python has failed in many ways.

This is exactly the kind of discussion I came here for. Thanks.

@devdanzin

Regarding specifics and immutable objects, please read There is a way to access an underlying mapping in MappingProxyType · Issue #88004 · python/cpython · GitHub. Is it enough for you to believe not even MappingProxy is safe from Python’s mutability shenanigans?

Interestingly, this is probably still a bug in the python implementation. But let’s quickly improve the implementation a little. And this is only a superficial improvement. Can come up with much better implementations.

from types import MappingProxyType

orig = {1: 2}
mp = MappingProxyType(orig)

class MP:
	def __getitem__(self, name):
		return mp[name]
		
	def __setitem__(self, name, value):
		raise AttributeError()

proxy = MP()

class X:
	def __eq__(self, other):
		other[1] = 3
		
assert proxy[1] == 2
proxy == X() # AttributeError

@devdanzin

Regarding the audit hooks as a security feature, I’ll quote the docs

Yes, there is a separate item specifically about C code execution in the original message.

@devdanzin

Also, some expected audit hooks are missing, finding similar issues would offer exploit opportunities to breaking your proposed security system:

Again, it seems to be about executing third-party C code. Its execution will have to be prohibited if security is needed only specifically for third-party python modules. We are talking about security only at the level of the python interpreter, which means that C code execution will have to be prohibited.

@devdanzin

So you’d be talking about plugging holes and disabling insecure features… which has been shown not to work in general, using a feature that is explicitly listed as not suitable for security.

But can we still have an example where the bypass occurs only through python code?
It’s another matter if we come to the conclusion that python is thoroughly saturated with bugs and vulnerabilities. Is there really a lack of specific examples of problems here, so as not to give away how bad everything is with the internal implementation?
But so far I have seen only one example of a bug specifically when executing python code. And it turned out to be quite fixable.

@devdanzin

Even currently maintained projects like RestrictedPython

Are you familiar with its insides?

@devdanzin

I hope this helps.

And I hope that we will have a lot more discussions in the same style
By the way, here’s another thought. In fact, I’m acting as a python defender here. And everyone else seems to want to prove how bad python is and is teeming with problems.
Although it would seem that it should have been exactly the opposite.

[TIGirardi (Tiago Illipronti Girardi)]

@mwr

Again, it seems to be about executing third-party C code.

This was specifically about the stdlib, not third party.

[zware (Zachary Ware)]

@mwr

And everyone else seems to want to prove how bad python is and is teeming with problems.

Not so; everyone is trying to point out to you that Python is teeming with problems if you want to implement a sandbox. If you’re not trying to create a sandbox, everything is fine and useful, and it’s the useful things that cause problems for sandboxing attempts.

Maybe one could eventually create a sandbox within Python, but it’s unlikely that it would still be usable as Python. I’m afraid the only way to prove this wrong is to try it, but I personally believe it would be a waste of your time.

[devdanzin (Daniel Diniz)]

@mwr

@devdanzin

Regarding specifics and immutable objects, please read There is a way to access an underlying mapping in MappingProxyType · Issue #88004 · python/cpython · GitHub. Is it enough for you to believe not even MappingProxy is safe from Python’s mutability shenanigans?

Interestingly, this is probably still a bug in the python implementation. But let’s quickly improve the implementation a little. And this is only a superficial improvement. Can come up with much better implementations.

I’m sure you can. Many have. The issue is, all of them gave up after studying the problem space a bit. I’d like to offer a bit of code with examples of trivial ways to bypass proxies that worked for other systems as an example:

class X:
    def __eq__(self, other: MP):
        other.__class__.__setitem__.__globals__["orig"][1] = 3
        try:
            other.__setitem__("a", "b")
        except AttributeError as e:
            e.__traceback__.tb_frame.f_builtins["__import__"]("os").system("echo Python finds a way")
            other.__class__.__setitem__ = lambda self, a, b: print("A way")
            other[1] = "not important"
        try:
            other[2]
        except KeyError as e:
            mp = e.__traceback__.tb_frame.f_back.f_locals["mp"]
            import gc
            refs = gc.get_referents(mp)
            refs[0][1] = 5

assert proxy[1] == 2
proxy == X()
print(proxy[1])
# assert proxy[1] == 2

[mwr]

@devdanzin

The issue is, all of them gave up after studying the problem space a bit. I’d like to offer a bit of code with examples of trivial ways to bypass proxies that worked for other systems as an example

Yes, and there is a separate item about frames in the original message.
I’m sure that it’s possible to find an implementation where the frames will also be immutable.
But this requires the help of developers who probably understand the possible variants for such an implementation. Perhaps such variants have even already been implemented in someone’s projects.

[Rosuav (Chris Angelico)]

@mwr

But this requires the help of developers who probably understand the possible variants for such an implementation. Perhaps such variants have even already been implemented in someone’s projects.

Why do you KEEP ON assuming that someone else will do all the work for you? Get out there and actually write it if you think it’s possible. Otherwise, stop repeatedly posting that you think it ought to be possible, and expecting other people to do the work of implementing it.

[mwr]

@zware

everyone is trying to point out to you that Python is teeming with problems if you want to implement a sandbox

That’s do you think it’s normal when in the example above (There is a way to access an underlying mapping in MappingProxyType · Issue #88004 · python/cpython · GitHub) we can take and change the value inside MappingProxy?
This is clearly an internal implementation bug.

@zware

I’m afraid the only way to prove this wrong is to try it, but I personally believe it would be a waste of your time.

I also have doubts about the possibility. Otherwise, I wouldn’t be asking questions.
But every time there are examples of problems at the python level itself, and so far I am constantly finding possible solutions to them.
And here there are two options: either the problems are still solvable or the other real problems are carefully hidden

[mwr]

@Rosuav

and expecting other people to do the work of implementing it

Why is there always an equal sign between the discussion of possible implementation variants and the implementation itself?
Has no implementation inside python ever been accompanied by lengthy discussions?
And if at least some of it was accompanied, stop accusing me of what I’m not offering.
If you don’t want to discuss it, don’t discuss it. But stop bullying just about ideas and their discussions.
Half of the comments in this topic can also be deleted because they relate to what I did not suggest or relate to some third-party things. And if I reacted to every such meaningless remark, and this topic could already be closed.
But now there are people who understand the problems in essence and discuss them in essence. And I hope these are not the last such experts here.

[mikeshardmind (Michael H)]

This just fundamentally doesn’t make sense to exist at the interpreter level for a general-purpose programming and scripting language. One person’s intentional modification is another’s vulnerability. I can use python to rewrite firewall rules. That’s not inherently malicious, and there is no way to detect whether the intent is malicious. I could remove firewall configuration entirely. That might be fully intended as part of deployment via ansible to switch to new tools or new versions of the same tools that handle their configuration differently.

You can already sandbox python from outside of python rather successfully with tools actually built for this, from anything to a full sandbox, to capability restrictions placed on the process/service, to process namespacing and resource limitations, and blends of those.

You can also ensure python isn’t available for use by users that shouldn’t be writing or executing arbitrary code, but restricting what users can do is still better handled at another layer here. If a user launches a python process and doesn’t have permission to modify the previously mentioned firewall rules, python can’t for them either.

You’re getting a lot of detraction here because you are continuously suggesting what people perceive as the wrong tool for the job, without any demonstration of how decades of diverse expert opinions on the matter have all reached the same conclusion is somehow wrong.

[mwr]

@mikeshardmind

This just fundamentally doesn’t make sense to exist at the interpreter level for a general-purpose programming and scripting language.

There is no point in implementing event auditing at the interpreter level for a general-purpose programming and scripting language. Because it is exactly the same way to analyze the work of the code through third-party independent tools.
But it exists contrary to the opinion of many. And its implementation can no longer be removed and it cannot be said that this is impossible. There were just people who believed, discussed, and then implemented.
And in addition it also appeared

sys.monitoring — Execution event monitoring

Which seems to be a very promising tool for some of the checks described above.

@mikeshardmind

One person’s intentional modification is another’s vulnerability.

Therefore, such a system must be configurable and deactivable. How event auditing is implemented.

@mikeshardmind

You’re getting a lot of detraction here because you are continuously suggesting what people perceive as the wrong tool for the job

I don’t mind criticism at all. But it’s one thing when criticism is accompanied by concrete examples, and I give specific counterexamples.
And it’s another thing when criticism is just for the sake of criticism. Who exactly is this newcomer and what ideas does he even allow himself

@mikeshardmind

without any demonstration of how decades of diverse expert opinions on the matter have all reached the same conclusion is somehow wrong

Above is an article by Victor Stinner. I took it apart. And has anyone commented on my analysis? Rather, they commented: now take and implement it, and then come discuss it. I’m not offended, I understand that there are those here who are ready to just argue for the sake of arguing. Therefore, I will patiently wait for other comments with python specifics and discuss them.

[Nineteendo (Nice Zombies)]

Should slow mode be activated? The OP has made 17/38 (45%) posts in this topic.

[mikeshardmind (Michael H)]

I’m only going to add a few things and then bow out, I don’t see this going anywhere productive, but I do hope that you can come to appreciate why.

@mwr

There is no point in implementing event auditing at the interpreter level for a general-purpose programming and scripting language. Because it is exactly the same way to analyze the work of the code through third-party independent tools.
But it exists contrary to the opinion of many. And its implementation can no longer be removed and it cannot be said that this is impossible. There were just people who believed, discussed, and then implemented.

This is one of the first things you’ve said in this thread I’ve agreed with, but not in the way you probably think. I don’t think the sys audit functions should exist because they exist at a level where they can’t effectively audit. By being in the interpreter, they are subject to modification by the interpreter itself. Even if these events are useful they should not be presented as preventative security tools. We’re stuck with them as is for backwards compatibility reasons, and it seems that people are confused by what they are actually capable of.

@mwr

@mikeshardmind

One person’s intentional modification is another’s vulnerability.

Therefore, such a system must be configurable and deactivable. How event auditing is implemented.

How is this better than using existing tools that are not subject to issues of existing at the same process scope as the things they are intended to restrict? You’ll find that the ability to attach a debugger means that one python process can disable another python process’s protections if these are controlled by the same code meant to also run untrusted code.

@mwr

@mikeshardmind

without any demonstration of how decades of diverse expert opinions on the matter have all reached the same conclusion is somehow wrong

Above is an article by Victor Stinner. I took it apart. And has anyone commented on my analysis?

No, you did not take it apart, and many people have commented on various aspects about it, but many people up until now probably ignored engaging with it because of how much of this doesn’t seem to acknowledge that the better tools exist and there are reasons to do this at a layer above the interpreter. You have provided nothing that shows a benefit to place it in the interpreter itself.