Arbitrary Code Execution on Server

Question

I am trying to build a web application (running on Linux servers) in which the user will upload an executable, the executable will be ran against a particular input available on the server (fed via STDIN), and the output (read from STDOUT) will be returned to the user.

Of course, I do not want the user to be able to do anything malicious on my server. I would like to run the executable in a sandbox, or otherwise prevent the executable from executing sensitive system calls.

I have no idea where to start from. I checked out User-Mode Linux, but it seems to have too much overhead (many executables will be running in parallel, and having a VM for each one is way too much overhead).

How should I proceed?

Edit: I understand this is something one normally avoids. I understand there are risks. Consider this as something you would do for the sake of learning how it can be done. I have seen it done before on places like CodePad and geordi, sometimes it is a very convenient thing to do.

Answer 1

You're taking a massive, massive risk running untrusted code. I would completely rethink both what I wanted to do and the fundamental assumptions of my project if the answer to my problem I came up with was "run untrusted code from arbitrary users on my server".

Answer 2

You can give a try to librestrict.

It is a small library designed to be LD_PRELOAD-ed before starting a given executable, basically works by chroot()ing into a given directory, then removing all capabilities (except ones based on a whitelist) then setuid()-ing to a given user, preventing the given executable from doing nasty things.

One of the beauties of this program is that it chroot()s after the system has loaded all the necessary libraries, therefore if you are lucky (it does not want to dl() some other libs) you can use it with an empty directory, as a chroot() environment.

Though, it's a bit old and undocumented, you can give it a try, I can give you a hand.

Answer 3

I think running executables in a VM is your best bet. For example, there's a bot on the #bash IRC channel that allows for the execution of arbitrary shell code...by running it inside a qemu based VM and then capturing the stdout of that process. UML is probably a reasonably good solution.

The new lguest stuff (http://lguest.ozlabs.org/) is probably better; this is "container" mechanism, rather than a full-on "virtualization" solution; something like Solaris Zones. I don't know what the state of this project is right now.

Answer 4

Does it have to be an executable file? Could you restrict uploaded programs to be for example source code in some scripting language (python, ruby) which have some kind of sandbox executing environment. Or bytecode for something like C# or Java? At least C# and Java have built in security mechanism for allowing and disallowing operations.

You could then more easily restrict what the uploaded programs can do and cannot do.

Answer 5

I tried something similar, and have chosen grsecurity-enabled kernel plus read-only bind mounts for sharing system files between host and sandbox. Then the testing app was started in chroot-ed sandbox. When done, all processes belonging to sandbox user are killed with SIGKILL and any user-modifiable files erased and replaced from original. While it may not be so completely safe as virtual machine it comes very close when done right. The advantage is much less overhead.