pysandbox vs pypy-sandbox
pysandbox vs pypy-sandbox
Posted Apr 29, 2015 3:26 UTC (Wed) by gmatht (subscriber, #58961)In reply to: Unsafe Blocks by Cyberax
Parent article: Rust Once, Run Everywhere
I understand that pysandbox used a blacklist. Blacklists have a poor reputation even when not combined with local code execution, so I am not surprised the author gave up. Heck, Linux is designed to be reasonably secure for a monolithic kernel, rather than just layering a pysandbox-like hack on top. Yet, Linux has had a long list of security vulnerabilities. Folk wisdom seems to be not to trust the Linux Kernel's normal security model, and to contain any locally executed untrusted processes with something like SECCOMP.
What is your opinion of the security of the PyPy Sandbox model? I understand it uses a very short whitelist similar to SECCOMP. I haven't heard of any vulnerabilities, though that may just be because it is so new.