Revert the capability set, and say what isolated mode bounds - #85
Merged
Conversation
Enforcing what a child may reach from inside CPython does not work: an audit hook never sees a C extension, and the open event does not say which directory a relative path resolves against, so the containment could be walked around with documented calls. The tree returns to 5.0.0 and the guides say plainly that the child holds every authority the node's user holds, with the operating system mechanisms that do bound it.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
capspromised to bound what an isolated child may reach and could not keep the promise. Enforcing it inside CPython means an audit hook, and an audit hook never sees a C extension callingopen(2), which is most of the code you run isolated mode for. It also cannot tell which directory a relative path resolves against, because theopenevent does not carrydir_fd, so path containment could be walked around with documented calls and a grant the caller was given. That is not fixable in Python, and a feature shaped like a security control that is not one is worse than no feature.This reverts it. The tree returns to 5.0.0 exactly.
What replaces it is the truth, in the two guides where someone would look: the child holds every authority the user running the node holds, isolated mode bounds what Python may consume rather than what it may reach, and the mechanisms that do bound reach are the ones the operating system already has around the node (a container or jail, a separate user, a systemd unit with
ProtectSystemandIPAddressDeny). Kernel sandboxing per context would let the library express it directly and is not implemented.