Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I'm building an application that will enable users to write code from the browser. Once the code is written I save the contents to my webserver in a user-specific folder.

I'd also like to add a feature whereby the user can run the code in the language of their choice: ruby, python, etc...

Obviously I don't want to just run the code 'as is' since the user may have dangerous code which may delete sensitive files from the webserver.

How can I architect a secure system where each user would have their own custom environment to run the code they have written, in the language of their preference?

share|improve this question

3 Answers 3

up vote 0 down vote accepted

Perhaps, the only way to do it securely is to run the code inside virtual machine or emulator. Running in under the same user and/or under chroot is still too dangerous: there may be local security issues which would enable users to gain root and go out of chroot.

If you believe you'll be able to keep your system up to date and there's nothing very importand there (like database with customer's card number), take a look to this project: http://sandbox.sourceforge.net/

Please note: for compiled languages you also need to compile in some kind of sandbox. #include /etc/passwd is simplest thing you won't want users to have.

share|improve this answer
    
Thanks rvs. I will take a look at the sandbox project. –  DevX Dec 23 '11 at 20:53

You don't specify what server platform you are using.

Assuming you are using Apache, you should use the suexec module for this and adjust the directory permissions of the different users.

share|improve this answer

Virtual machines are the key. Each one is best separated from the other. There is only one better solution: Don't give them any access.

share|improve this answer
    
Can you explain how I might setup a virtual machine? (I'm not a linux expert) –  DevX Dec 23 '11 at 20:39
    
Amazon-ec2 already is a virtual machine. How to setup your own? Follow the manual. Of which VM? Don't know. Which one do you want to use? Do some research before asking. –  mailq Dec 23 '11 at 20:42

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.