Notes about Python Security.

tav's jail

http://tav.espians.com/a-challenge-to-break-python-security.html

Zope security

http://svn.zope.org/zope.security/trunk/src/zope/security/

Taint mode

Nicole King at one point wrote a taint mode for CPython 3.0, but the site (http://www.cats-muvva.net/software/) is no longer functioning.

Problems:

=> ncoghlan: PyPy is still a *much* better platform for that kind of experimentation than CPython

See also the presentation: Securing Python: Controlling the abilities of the interpreter, PyCon US 2007, Brett Cannon and Eric Wohlstadter

Related issue: Taint a la Perl?.

Python Security Response Team

Some members:

Email: security AT python.org

Controlling Access to Resources Within The Python Interpreter

Sandboxing

Unsafe modules

Fuzzing

Victor Stinner wrote a fuzzer called Fusil to test Python. It already helped to fix many bugs. fusil-python works on Python 2.4 .. 3.0.

Fusil was also used on PyPy (Finding Bugs in PyPy with a Fuzzer).

Security (last edited 2019-12-15 07:15:55 by FrancesHocutt)

Unable to edit the page? See the FrontPage for instructions.