0 purchases
Description:
landlock 1.0.0.dev4
🔒🐍 Landlock for Python
Harden your Python code by with rule-based file system access restrictions.
Example
Let's write a simple HTTP server that serves files in the local directory.
from http.server import HTTPServer, SimpleHTTPRequestHandler
server = HTTPServer(("", 8000), SimpleHTTPRequestHandler)
server.serve_forever()
But if there's a symlink in the local directory, the program can "escape".
$ ln -s /etc oops
$ python3 test.py &
[1] ...
$ curl localhost:8000
...
$ curl localhost:8000/oops/passwd
uh oh
$ kill $!
[1]+ Terminated python3 test.py
Now let's harden our server with Landlock!
from http.server import HTTPServer, SimpleHTTPRequestHandler
from landlock import Ruleset
server = HTTPServer(("", 8000), SimpleHTTPRequestHandler)
# the ruleset by default disallows all filesystem access
rs = Ruleset()
# explicitly allow access to the local directory hierarchy
rs.allow(".")
# turn on protections
rs.apply()
server.serve_forever()
And now we get a permission denied error if we try and access files outside the current directory,
even via a symlink:
$ python3 test.py &
[1] ...
$ curl localhost:8000
...
$ curl localhost:8000/oops/
127.0.0.1 - - [DD/MMM/YYYY HH:MM:SS] code 404, message No permission to list directory
...
$ kill $!
[1]+ Terminated python3 test.py
Success! Instead of dumping the password file, we instead get a permission error!
Landlock is great for hardening applications against both accidental programming mistakes,
and attacks.
It won't prevent an exploited application from all malicious behavior,
but it can stop it reading with the filesystem and interacting with device files.
Developer Information
Testing
Tests are run using pytest.
Each test is run in a separate subprocess using pytest-forked
so Landlock rules don't conflict.
License
For personal and professional use. You cannot resell or redistribute these repositories in their original state.
Files:
Customer Reviews
There are no reviews.
