Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We have a Node application as the front end to a C++ sandboxing tool, which compiles code using gcc and outputs the result to the browser.

e.g.

  exec("gcc -o /tmp/test /tmp/test.cpp", 
    function (error, stdout, stderr) {
      if(!stderr) {
        execFile('/tmp/test', function(error, stdout, stderr) {});
}
});

This works fine.

However, as you can imagine this is a security nightmare if it were to be made public - so I was thinking of two options to protect my stack:

1) A CHROOT jail - but this in itself wouldn't be enough to prevent directory traversal / file access.

2) AppArmor ?

So my question is really, how could I protect my stack from any nasties that could come from:

A) Compiling unknown code using gcc

B) Executing the compiled code

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

It entirely depends on how much is at stake and what you are willing to sacrifice for securing it.

The chroot jail is likely to only offer a poor level of protection and would especially leave the potential attacker with access to the network and all computational resources of your host machine as well as the ability of elevating local privilege escalation exploits (which happen to be discovered quite often in all kinds of software packages, even including the Linux Kernel).

A MAC solution (SELinux, AppArmor, TOMOYO) would allow for a finer level of control, especially including network access, but MACs are not all that unbreakable.

Another level of sandboxing would include intercepting all system calls - pretty much what you see with Seccomp. But obviously, creating a useful profile here would be an awful lot of work.

You could go even further and spin off a virtual machine or a container for each instance of your executed code - this is where you are likely to have the highest level of control over resource usage and separation from the host's data - but this is likely to become expensive for anything but a trivial case with just a handful of users.

share|improve this answer
    
Thanks for the suggestions, seccomp seems to do what I wanted :) –  StuR Nov 23 '12 at 11:52
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.