[Author Prev][Author Next][Thread Prev][Thread Next][Author Index][Thread Index]

Re: [pygame] Python bots in Galcon (or your game!) safe_eval

Hi,

One further step you could take would be running the bots as separate
processes with lower OS level privileges, or sandbox.

So with unix you could then use ulimit to limit files opened, memory
used, etc etc.  Type ulimit -a to see a list of things you can change.

The process would need some way to talk, however since you are already
using networking to communicate this should be easy.

This would help reduce the chance of denial of service attacks through
cpu use, and memory use.

Chroots(unix), and jails(*bsd) would be possible... but maybe a little
bit too much effort.  I'm not sure what facilities are available on
windows... but I'm sure there is something you can do to limit what a
process can do.


Cheers,



On 3/8/07, Phil Hassey <philhassey@xxxxxxxxx> wrote: 
Hey,

I spent some time today working on building a safe_eval function that would
make it "safe" to run user submitted bots in games (Galcon, being that game
;)

http://www.imitationpickles.org/tmp/safe.py

The file includes links to a number of references on the topic, and why
likely this won't work.  Anyway - I know a lot of you wanted to make bots
for Galcon, so that's why I'm trying to put this together.  So if anyone can
find security holes in my implementation, it would be a huge help - the more
I find and get patched the more likely I am to actually release Galcon with
ability for bot-plugins.

The known limitations at the top are things that I don't really want to fix
- they are just limitations.  :)  I'm mainly interested in limiting what a
bot can access (say other parts of the game code) and keeping them from
using builtins like files, etc.

The two things I do in this script are:
- Step through the AST tree and reject scripts that use any non-whitelisted
node types.  A lot of python features are dropped, but enough are kept for
building decent bots (the main bot from Galcon is "ok" as far as safe.py is
concerned.)  I pretty much reject anything that falls into the magic
category - generators, imports, execs, exceptions, etc...
- Replace non-whitelisted builtins with a function that raises an exception
"you used a bad builtin!", runs "exec code in context" and then restores all
the builtins.

Anyway, feel free to poke around the code.  I think a working safe_eval
would be a huge asset for games developed in python that want to have user
submitted mods / bots.

Thanks!
Phil


 ________________________________
It's here! Your new message!
Get new email alerts with the free Yahoo! Toolbar.