Differences between revisions 5 and 6
Revision 5 as of 2008-12-05 15:00:41
Size: 1487
Editor: hachoir
Comment:
Revision 6 as of 2008-12-05 15:03:47
Size: 1682
Editor: hachoir
Comment:
Deletions are marked like this. Additions are marked like this.
Line 5: Line 5:
Nicole King (cats-muvva.net) wrote a taint mode for CPython 3.0: http://www.cats-muvva.net/software/ Nicole King (cats-muvva.net) wrote a taint mode for CPython 3.0: [[http://www.cats-muvva.net/software/|Python Taint Management]].
Line 14: Line 14:
See also the presentation: [http://us.pycon.org/common/talkdata/PyCon2007/062/PyCon_2007.pdf Securing Python: Controling the abilities of the interpreter], PyCon US 2007, Brett Cannon and Eric Wohlstadter See also the presentation: [[http://us.pycon.org/common/talkdata/PyCon2007/062/PyCon_2007.pdf|Securing Python: Controling the abilities of the interpreter]], PyCon US 2007, Brett Cannon and Eric Wohlstadter
Line 25: Line 25:
 * URL: http://sayspy.blogspot.com/2007/04/python-security-paper-online.html
 * Paper: [http://www.cs.ubc.ca/~drifty/papers/python_security.pdf Controlling Access to Resources Within The Python Interpreter], Brett Cannon and Eric Wohlstadter, University of British Columbia
 * URL: [[http://sayspy.blogspot.com/2007/04/python-security-paper-online.html|Python security paper online]]
 * Paper: [[http://www.cs.ubc.ca/~drifty/papers/python_security.pdf|Controlling Access to Resources Within The Python Interpreter]], Brett Cannon and Eric Wohlstadter, University of British Columbia
Line 30: Line 30:
See PyPy project: [http://codespeak.net/pypy/dist/pypy/doc/sandbox.html PyPy's sandboxing features]. See PyPy project: [[http://codespeak.net/pypy/dist/pypy/doc/sandbox.html|PyPy's sandboxing features]].
Line 36: Line 36:
   * [http://bugs.python.org/issue1179 [CVE-2007-4965] Integer overflow in imageop module] (2007-09 .. 2008-08)    * [[http://bugs.python.org/issue1179|CVE-2007-4965: Integer overflow in imageop module]] (2007-09 .. 2008-08)
   * [[http://bugs.python.org/issue4317|Buffer overflow in imageop module]] (rgb2rgb8): fixed in Python 2.6.1 and Python 3.0

Notes about Python Security.

Taint mode

Nicole King (cats-muvva.net) wrote a taint mode for CPython 3.0: Python Taint Management.

Problems:

  • amaury: The patch is indeed huge!

  • fijall: it seems that every function that returns a PyObject must be modified

  • fijall: need to patch (...) all places that might modify anything. (All side effects)

=> ncoghlan: PyPy is still a *much* better platform for that kind of experimentation than CPython

See also the presentation: Securing Python: Controling the abilities of the interpreter, PyCon US 2007, Brett Cannon and Eric Wohlstadter

Python Security Response Team

Some members:

  • Brett Cannon

Email: security AT python.org

Controlling Access to Resources Within The Python Interpreter

Sandboxing

See PyPy project: PyPy's sandboxing features.

Unsafe modules

Security (last edited 2009-09-14 09:54:15 by PaulBoddie)

Unable to edit the page? See the FrontPage for instructions.