0

We have a Node application as the front end to a C++ sandboxing tool, which compiles code using gcc and outputs the result to the browser.

e.g.

exec("gcc -o /tmp/test /tmp/test.cpp",
    function (error, stdout, stderr) {
        if(!stderr) {
            execFile('/tmp/test', function(error, stdout, stderr) {});
        }
    }
);

This works fine.

However, as you can imagine this is a security nightmare if it were to be made public - so I was thinking of two options to protect my stack:

  1. A CHROOT jail - but this in itself wouldn't be enough to prevent directory traversal / file access.
  2. AppArmor ?

So my question is really, how could I protect my stack from any nasties that could come from:

A) Compiling unknown code using gcc

B) Executing the compiled code

1 Answer 1

1

It entirely depends on how much is at stake and what you are willing to sacrifice for securing it.

The chroot jail is likely to only offer a poor level of protection and would especially leave the potential attacker with access to the network and all computational resources of your host machine as well as the ability of elevating local privilege escalation exploits (which happen to be discovered quite often in all kinds of software packages, even including the Linux Kernel).

A MAC solution (SELinux, AppArmor, TOMOYO) would allow for a finer level of control, especially including network access, but MACs are not all that unbreakable.

Another level of sandboxing would include intercepting all system calls - pretty much what you see with Seccomp. But obviously, creating a useful profile here would be an awful lot of work.

You could go even further and spin off a virtual machine or a container for each instance of your executed code - this is where you are likely to have the highest level of control over resource usage and separation from the host's data - but this is likely to become expensive for anything but a trivial case with just a handful of users.

1
  • Thanks for the suggestions, seccomp seems to do what I wanted :)
    – StuR
    Nov 23, 2012 at 11:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .