research PyPy for better python script security

[phabricator-migrator]

Information

ID: 129
PHID: PHID-TASK-ju33uncgjm6uymgyf4gz
Author: Patrick
Status at Migration Time: resolved
Priority at Migration Time: Normal

Description

Find out if PyPy and/or PyPy’s sandbox would be useful to increase security.

A good good candidate for testing and confinement, because relatively simple to play with, would be url_to_unixtime (T102). Later also control-port-filter-python.

See also:

• Security Enhancements for Python scripts - PyPy

Related:

• research seccomp for better python script security: T128 [if we start using pypy, we might not need T128]

Comments

---

HulaHoop

2015-06-18 01:11:56 UTC

PyPy’s sandbox is an experimental proof-of-concept and will not be operational any time soon.

The project’s dev’s comments point out that even the only python module that worked with it, the ‘time’ module, no longer does and was removed. To support a decent amount of python features a lot of work is needed in addition to long-term maintenance investment.

python - setting up sandbox version of pypy - Stack Overflow

---

systemd.exec integrates and exposes Linux’s security features in an easy to use manner. It was chosen instead.

Whonix Forum