From simon.urbanek at r-project.org  Wed Dec 19 18:12:07 2012
From: simon.urbanek at r-project.org (Simon Urbanek)
Date: Wed, 19 Dec 2012 12:12:07 -0500
Subject: [Rd] Scanning a R script for potentially insidious commands
In-Reply-To: <CADwqtCM_OB_HqQ1bHYzKfN00NH41+PGyT0_HcC3aQhSv0TDp0A@mail.gmail.com>
References: <50D06614.9060404@epiconcept.fr>
	<C388E3C2-611A-4717-8049-D72867AB8BCB@gmail.com>
	<CAO1zAVbqQXsBEz7Uvdjqi0FxE2NxMb3fTZ5MuEFgn3KSaLb_xw@mail.gmail.com>
	<20121219120210.GA4036@paxarchia.galaxy.uni>
	<CAO1zAVaXwrt_f1LN29kJz-2XvoOYn5rz-EuuHnqYfXWrL2sJPg@mail.gmail.com>
	<20689.49717.671544.744493@max.nulle.part>
	<CADwqtCM_OB_HqQ1bHYzKfN00NH41+PGyT0_HcC3aQhSv0TDp0A@mail.gmail.com>
Message-ID: <52342EBD-789E-4048-AA05-30A44C535321@r-project.org>

On Dec 19, 2012, at 11:21 AM, Gabriel Becker wrote:

> See also: https://github.com/Rapporter/sandboxR
> 
> sandboxR (not written by me) is a proof of concept for security inside R
> (as opposed to security outside R as discussed above) via evaluating all R
> commands in a specialized security environment (R environment that is)
> which contains safe replacements for blacklisted functions.
> 

It is a good example of false security. For the reasons mentioned before this doesn't work and can be circumvented:

> sandbox("XXXX('tail /etc/group')")
_developer:*:204:
_locationd:*:205:
_carddav:*:206:
_detachedsig:*:207:
_trustevaluationagent:*:208:
_odchpass:*:209:
_timezone:*:210:
_lda:*:211:
_cvms:*:212:
_usbmuxd:*:213:
[1] 0

The problem is that you can try to plug holes (and sandboxR is trying hard to plug a lot of them), but there will always be new ones. It's simply the wrong approach IMHO.

Cheers,
Simon



> HTH,
> ~G
> 
> 
> 
> On Wed, Dec 19, 2012 at 5:33 AM, Dirk Eddelbuettel <edd at debian.org> wrote:
> 
>> 
>> Jeroen has a package devoted to the sandboxing approach in conjunction with
>> the system-level AppArmor facility:  RAppArmor.  See
>> 
>>  http://cran.r-project.org/web/packages/RAppArmor/index.html
>> 
>> and more details at
>> 
>>  https://github.com/jeroenooms/RAppArmor#readme
>> 
>> Dirk
>> 
>> --
>> Dirk Eddelbuettel | edd at debian.org | http://dirk.eddelbuettel.com
>> 
>> ______________________________________________
>> R-devel at r-project.org mailing list
>> https://stat.ethz.ch/mailman/listinfo/r-devel
>> 
> 
> 
> 
> -- 
> Gabriel Becker
> Graduate Student
> Statistics Department
> University of California, Davis
> 
> 	[[alternative HTML version deleted]]
> 
> ______________________________________________
> R-devel at r-project.org mailing list
> https://stat.ethz.ch/mailman/listinfo/r-devel
> 
> 



[Rd] Scanning a R script for potentially insidious commands
Simon Urbanek