Take the 2-minute tour ×
Programmers Stack Exchange is a question and answer site for professional programmers interested in conceptual questions about software development. It's 100% free, no registration required.

I would like to set up an app that allows users to send their code and execute it on my server. The thought of running untrusted code makes me cringe, so I am trying to set up an exhaustive list of security threats that should be addressed.

I am assuming I should strip down certain features of the language executed, like file access or (maybe) networking. I also come across terms like sandboxing or chroot. I know what they mean, but how should I actually use them?

In short: What security threats should I address before allowing users to run their code on my machine, and how do I do it?

share|improve this question
2  
Basically, if someone can run arbitary code on your server, it's not, in fact, your server anymore. –  Michael Borgwardt Nov 2 '12 at 10:23
    
@MichaelBorgwardt: as long as the arbitrary code doesn't have full access to the server's resources, I'd argue otherwise. –  tdammers Nov 2 '12 at 10:32
1  
@tdammers: privilege escalation vulnerabilities are so numerous that I wouldn't put too much faith in anything below full virtualization. –  Michael Borgwardt Nov 2 '12 at 10:41
add comment

1 Answer

up vote 6 down vote accepted

The most important concerns include:

  • System resources (DoS). If you allow arbitrary code execution on your systems, then it is easy to deplete system resources on that machine, on purpose or by accident. Writing code that fills the entire hdd with garbage is easy, preventing it without severely crippling the system is much harder. The same goes for other system resources, such as CPU cycles, RAM, network bandwidth, etc.
  • Data breaches. If other users are on the same server, and an attacker manages to read their data, you have a problem. If that data is confidential, you have an elephant-sized problem.
  • Network integrity. Allowing arbitrary code execution means users can initiate and accept network connections from your server, and depending on your network configuration, this may allow them to access things inside your network that aren't supposed to be reachable from the outside.
  • Illegal activity. A server that allows arbitrary code is an invitation for shady things: your machine could be used to store offending data, hide communication, or, more likely, perform attacks on other targets.

IMO, the easiest way to defend against these and mitigate the risks is by using virtual machines: give each user a dedicated VM with a stripped-down OS and no root access; lock down network access (ideally, the machine accepts incoming ssh connections and nothing else, and cannot initiate any outgoing connections - if you have to allow anything else, keep it as restrictive as possible), limit host resource usage, and regularly restore the machine to a blank state. Additionally, you may want to monitor VM activity from the outside.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.