Question

While I do know that system calls and security don’t go hand in hand, there is a project for which I do need it. I’m writing a small code checker and I need to compile and execute the user submitted code to test against my test cases.

Basically I want to run the code in a sandbox, so that it can’t touch any files outside of the temporary directory and any files that it creates can’t be accessed by the outside world.
Recently I came across an exploit with with which the user could create a file say shell.php with the following contents.

<?php
  echo system($_GET['x']);
?>

This gives the attacker a remote shell and since the owner of the file is apache, the attacker could basically move around my entire /var/www where mysql passwords were stored along with other configuration information.

While I am aware of threats like SQL Injections and have sanitized the user input before any operations that involve the DB, I have no idea as to how I can set up the sandbox. What are the techniques that I can use to disable system calls (right now I’m searching for the word ‘system’ in the user submitted code and not executing those snippets where it is found) and restrict the access to the files that the user submitted code creates.

As of now my code checker only works for C and I plan to add support for other languages like C++, Java, Ruby and Python after I can secure it. Also I’d like to learn more about this problem that I’ve encountered so pointers to a place where I could learn more about web security would also be appreciated.

My development machine is running Mac OS Lion and the deployment machine is a linux server so if a solution, that was cross platform would be most appreciated but one that dealt with just the linux machine would do too.

Answer 1

What you will probably want to do is set up a chroot to some random temp directory on your filesystem for the user running your scripts. Here is some reading on setting up a chroot, and some security to-know’s.

I would suggest you also install a security module such as suExec or MPM-iTK for Apache. Then, within your Apache’s VirtualHost (if you are not running a virtual host, do so!), assign a specific UserID to handle requests for this specific VirtualHost. This separates the request from the Apache default user, and adds a little security.

    AssignUserID nonprivilegeduser nonprivilegeduser 

Then, harden PHP a little by setting the following PHP options so the user cannot access files outside of the specific directories, and move your tmp_dir and session_save_path within this directory. This will prevent the users access outside of their base directory.

    php_admin_value open_basedir /var/www/
    php_admin_value upload_tmp_dir /var/www/tmp
    php_admin_value session.save_path /var/www/tmp

Along with the lines of PHP, prevent access to specific functions and classes, and read up on PHP’s security write-up.

Also, I would have you look into for that user, disabling access to sudo and su, to prevent a script from attempting to access root privileges. Learn more, here.

All in all, you said it nice and clear. There is no way to fully prevent a user from accessing your system if they have the will. The trick is to just make it as difficult as possible, and confusing as possible for them.