Python sandbox / Privilege separation
Sandboxing in Python doesn’t seem to be currently possible. All the stuff I’ve seen has known holes and isn’t considered secure. Not very encouraging. Hopefully in the future this will change and we’ll implement it. Still have to do something with sussen-sensor though, can’t have it being a security risk itself, which brings us back [...]
Python rexec
Reading about rexec which is a Restricted execution framework for Python. That might have been useful for Sussen but sadly the module has been disabled. Still looking…
Privileges
On the sussen-devel list it was asked if there was a sandbox around the Python plugins. Currently there is not and it’s actually not good. So I was taking another look at sandboxing and privilege separation in sussen-sensor. After some research it looks like privilege separation may not be feasible. I’m still looking into it. [...]
sussen-plugin IDs
The sussen-plugin IDs have been changed. It’s now sp-YYYY-XXXX, so thefirst plugin is sp-2004-0001. It will make sorting these much easier later on. I’ve updated CVS.
First full sussen-plugin
The first sussen-plugin (id: sp-0001-2004; name: ’12Planet Chat Server Error Message Installation Path Disclosure’) has been written and I tested it out and looks like it works. So now I’ve just got to find my groove and get the other 1869 of these plugins ported. Here is what the Python code looks like: # sp-0001-2004.py [...]