Sandboxing Ruby

Presented at RubyConf 11, this presentation is a brief introduction to sandboxing in Ruby.

Transcript

1. A Sandboxing Story* starring Ruby * narrated by Eric Allam
3. railsforzombies.org
5. railsforzombies.org
6. • Metafilter • Hacker News • Reddit • etc... Release Day
8. http://www.metafilter.com/97726/brains-brain1-brain2-brain3 DAMN YOU ZED SHAW!
9. eval "rm -rf *" fork while fork want = gets.chomp f = File.open("/etc/passwd")
10. puts '' puts 'Hello there, and what\'s your first name?' name = gets.chomp puts 'Your name is ' + name + '? What a lovely name!' puts 'You must have a middle name though?' name1 = gets.chomp puts 'Your middle name is ' + name1 + '? What a handsome middle name!' puts 'Lastly, your last name must be as dashing as the first two?, What is it if I may ask?' name2 = gets.chomp puts 'Please to meet you, ' + name + ' ' + name1 + ' ' + name2 +'. You sound like a fine specimen! ' insert credit
11. Thank you! and we are very sorry :(
12. duh, #gsub! black_list = %w(chmod chown File flock IO.ioctl Kernel syscall trap fork setpgid Process setsid setpriority egid ` Object HTTP IO Fiber GC IRB Module Thread Net:: ObjectSpace OpenSSL OpenURI require load __callee__ __method__ abort autoload binding eval exit fail fork open raise readline set_trace_func sleep spawn system throw trap taint untaint STDOUT STDERR %x exec connection popen send module_eval Base64 logger alias try to_sym begin rescue Exception Error ensure instance_variable logger).join('|') code.gsub!(Regexp.new(black_list), '')
13. duh, #gsub! black_list = %w(chmod chown File flock IO.ioctl Kernel syscall trap fork setpgid Process setsid setpriority egid ` Object HTTP IO Fiber GC IRB Module Thread Net:: ObjectSpace OpenSSL OpenURI require load __callee__ __method__ abort autoload binding eval exit fail fork open raise readline set_trace_func sleep spawn system throw trap taint untaint STDOUT STDERR %x exec connection popen send module_eval Base64 logger alias try to_sym begin rescue Exception Error ensure instance_variable logger).join('|') code.gsub!(Regexp.new(black_list), '') while $:.shift; end
14. Doing it better • better sandboxing techniques • live sandbox breaking competition • conclusion
15. What is “sandboxing”?
16. run untrusted code
17. run untrusted code • Protect against namespace pollution
18. run untrusted code • Protect against namespace pollution • Block dangerous operations
19. run untrusted code • Protect against namespace pollution • Block dangerous operations • limit resource utilization
20. run untrusted code • Protect against namespace pollution • Block dangerous operations • limit resource utilization • Protect secrets (/etc/passwd)
21. run untrusted code • Protect against namespace pollution • Block dangerous operations • limit resource utilization • Protect secrets (/etc/passwd)
22. run untrusted code • Protect against namespace pollution • Block dangerous operations • limit resource utilization • Protect secrets (/etc/passwd) Do something fun!
23. keep_methods = [:eval, : +, :to_s, :methods, :new, :__id__, :object_id, :equal?, :==, :undef_method, :puts, :__send__, :const_get] (Kernel.methods - keep_methods).each {|m| Kernel.__send__(:undef_method, m) rescue nil } Object.constants.each {|con| (Object.const_get(con).methods - keep_methods).each {|m| Object.const_get(con).__send__(:undef_method, m) rescue nil } } puts eval(%{#{ARGV[0]}}) sandbox.rb $ ruby sandbox.rb "1+1" 2 $ ruby sandbox.rb "system('echo HELLO')" sandbox.rb:7:in `eval': undefined method `system'
25. more fun more safe The sandbox tradeoff
26. we need to give our ruby users more drugs
27. we need to give our ruby users more drugs ruby!
31. From the beginning
32. is it $SAFE yet? code = params[:code] #=> "`rm -rf /`" code.tainted? # => true eval(code) # => world 'splodes $SAFE = 1 code = params[:code] #=> "`rm -rf /`" code.tainted? # => true eval(code) # => SecurityError: Insecure operation - eval
33. code = params[:cmd] #=> "`rm -rf /`" code = <<-RUBY $SAFE=3 #{code} RUBY Thread.new { eval(code) }.value # => SecurityError http://www.ruby-doc.org/docs/ProgrammingRuby/html/taint.html
34. “Considering that $SAFE has fallen out of use and there is a renewed interest in managing many namespaces/environments on a single VM, I figured hey.” - _why (http://www.ruby-forum.com/topic/150864)
35. Semantic Analysis ripper (ruby parser) + access control lists code = 'eval("evil")' pp Ripper.sexp code [:program, [[:method_add_arg, [:fcall, [:@ident, "eval", [1, 0]]], [:arg_paren, [:args_add_block, [[:string_literal, [:string_content, [:@tstring_content, "evil", [1, 6]]]]], false]]]]]
36. rubycop (0.5.0) code = "class Foo; end" policy = Rubycop::Analyzer::Policy.new Rubycop::Analyzer::NodeBuilder.build(code).accept(policy) # => false policy.whitelist_const('Foo') Rubycop::Analyzer::NodeBuilder.build(code).accept(policy) # => true https://github.com/rubymaverick/RubyCop
37. CALL_BLACKLIST = %w[ abort alias_method at_exit autoload ... syscall system trap undef __callee__ __method__ ].to_set.freeze
38. CONST_BLACKLIST = %w[ ARGF ARGV .... TOPLEVEL_BINDING Thread VERSION ].freeze
39. Only “sandboxes” the untrusted code
40. Cons
41. Cons • Doesn’t create an new isolated “environment”
42. Cons • Doesn’t create an new isolated “environment” • If code gets through it can do anything
43. Cons • Doesn’t create an new isolated “environment” • If code gets through it can do anything • Too restricted, not enough ruby
44. Cons • Doesn’t create an new isolated “environment” • If code gets through it can do anything • Too restricted, not enough ruby • scary ruby edge cases
45. Many many edge cases in ruby begin x rescue (`ls`; RuntimeError) => err end "abc#{`ls`}" :"abc#{`ls`}" `ls` %x[ls] system("ls")
46. 1.3 million submissions
47. freaky freaky sandboxes (a.k.a. “jails”) http://www.ruby-forum.com/topic/150864 jruby_sandbox Isolates Namespace: s = Sandbox.new s.eval <<-RUBY class Foo def self.bar; 'bar'; end end RUBY s.eval 'Foo.bar' # => 'bar' Foo # => NameError: uninitialized constant Foo
48. RubyInstanceConfig cfg = new RubyInstanceConfig(); ... SandboxProfile profile = new SandboxProfile(this); cfg.setProfile(profile); wrapped = Ruby.newInstance(cfg)
49. sand = Sandbox.safe sand.eval %{`echo HELLO`} # => "HELLO\n" sand.activate! sand.eval %{`echo HELLO`} #=> Sandbox::SandboxException: NoMethodError: undefined method ``' for main:Object Blocks dangerous operations:
50. Protects secrets: File.read('/etc/passwd') => "##\n# User Database etc.." s = Sandbox.safe s.activate! s.eval 'File.read("/etc/passwd")' #=> Sandbox::SandboxException: Errno::ENOENT: No such file or directory - /etc/passwd
51. Limits resource utilization sandbox.eval %{while; true; end}, timeout: 5 # => Sandbox::SandboxException: Timeout::Error: execution expired
52. Can give sandbox “capabilities” class Foo def bar; 'bar'; end end sandbox.ref(Foo) foo = sandbox.eval('Foo.new') # => #<Foo:0x7bc5b828> foo.bar # => 'bar'
54. Sandbox Breaker 3000 http://sandboxbreaker3000.herokuapp.com
55. The Freaky Theory of Sandboxes Allen Ginsberg
56. The Freaky Theory of Sandboxes Ginsberg’s Theorem: conservation of mass/energy entropy increases impossibility of reaching absolute zero
57. The Freaky Theory of Sandboxes Ginsberg’s Theorem: 1. You can’t win: conservation of mass/energy entropy increases impossibility of reaching absolute zero
58. The Freaky Theory of Sandboxes Ginsberg’s Theorem: 1. You can’t win: 2. You can’t break even: conservation of mass/energy entropy increases impossibility of reaching absolute zero
59. The Freaky Theory of Sandboxes Ginsberg’s Theorem: 1. You can’t win: 2. You can’t break even: 3. You can’t quite the game conservation of mass/energy entropy increases impossibility of reaching absolute zero
60. The Freaky Theory of Sandboxes There will always be another exploit One exploit is enough to take everything down No amount of exploits will stop us from trying
61. 1. You can’t win: The Freaky Theory of Sandboxes There will always be another exploit One exploit is enough to take everything down No amount of exploits will stop us from trying
62. 1. You can’t win: 2. You can’t break even: The Freaky Theory of Sandboxes There will always be another exploit One exploit is enough to take everything down No amount of exploits will stop us from trying
63. 1. You can’t win: 2. You can’t break even: 3. You can’t quite the game The Freaky Theory of Sandboxes There will always be another exploit One exploit is enough to take everything down No amount of exploits will stop us from trying
64. If you’d like to contribute • https://github.com/rubymaverick/RubyCop • https://github.com/omghax/jruby-sandbox • http://sandboxbreaker3000.herokuapp.com
65. Dray Lacy (omghax)
66. Thank you! • @eallam