Compare commits
3 Commits
Author | SHA1 | Date | |
---|---|---|---|
5286cf62f4 | |||
aaa8e3dd21 | |||
86fe1ba8b7 |
37
README.md
37
README.md
@@ -1,3 +1,38 @@
|
|||||||
# PyJail
|
# PyJail
|
||||||
|
|
||||||
Jailing tool for Python
|
PyJail is a jailing tool for Python
|
||||||
|
It allows you to jail Python programs in a closed off filesystem
|
||||||
|
|
||||||
|
## How to install
|
||||||
|
|
||||||
|
Installing PyJail is really simple! Just run `python3 ./install.py` in the directory
|
||||||
|
where the files are stored!
|
||||||
|
|
||||||
|
## Compatibility
|
||||||
|
|
||||||
|
As of now we're still working on a custom Python interpreter to make all programs
|
||||||
|
fully jailing compatible, sadly enough it's quite hard work.
|
||||||
|
So as of now it is compatible with all Python programs, **but** only some will be
|
||||||
|
properly confined.
|
||||||
|
|
||||||
|
## POSIX compatibility
|
||||||
|
|
||||||
|
We're also providing a (sort-of) POSIX compatible mode. This allows Python programs
|
||||||
|
made for Linux to also run natively on Windows. This is more meant for Windows
|
||||||
|
versions that don't feature WSL (Windows 7/8/8.1) but still need to run some
|
||||||
|
Linux only scripts.
|
||||||
|
|
||||||
|
### The 4 branches
|
||||||
|
|
||||||
|
Which branch works best for you?
|
||||||
|
Well, that's pretty simple. We have 4 branches (`main`, `next`, `edge` and `no-posix`).
|
||||||
|
If you want the most stable experience, then the `main` branch is for you.
|
||||||
|
If you want the lastest features, but also a more stable experience (compared to `edge`),
|
||||||
|
then the `next` branch is for you
|
||||||
|
If you want the bleeding-edge and don't care about stability, then `edge` is for you.
|
||||||
|
If you only need simple jailing and no POSIX compatibility, then `no-posix` is for you.
|
||||||
|
|
||||||
|
### Issues
|
||||||
|
|
||||||
|
Please report issues [over here](https://git.novacow.ch/Nova/PyJail/issues/)
|
||||||
|
And please check if your issue isn't a duplicate before reporting.
|
||||||
|
@@ -1,6 +1,6 @@
|
|||||||
"""
|
"""
|
||||||
Install script for the Python jailer.
|
Install script for the Python jailer.
|
||||||
Version: 0.2.0-alpha2
|
Version: 0.2.0-alpha1
|
||||||
"""
|
"""
|
||||||
import os
|
import os
|
||||||
import shutil
|
import shutil
|
||||||
@@ -43,7 +43,7 @@ if setup_posix.lower() == "y":
|
|||||||
with open("./lib64", "a+") as f:
|
with open("./lib64", "a+") as f:
|
||||||
f.write("symlnk /usr/lib64/")
|
f.write("symlnk /usr/lib64/")
|
||||||
f.close()
|
f.close()
|
||||||
with open("./usr/bin/sh", "a+") as f:
|
with open("./usr/bin/sh.py", "a+") as f:
|
||||||
f.write("symlnk /usr/bin/shell.py")
|
f.write("symlnk /usr/bin/shell.py")
|
||||||
f.close()
|
f.close()
|
||||||
os.mkdir("./sys")
|
os.mkdir("./sys")
|
||||||
|
54
main.py
54
main.py
@@ -1,6 +1,6 @@
|
|||||||
"""
|
"""
|
||||||
This is the PyJail, a jailing tool for running Python apps in a sandboxed environment.
|
This is the PyJail, a jailing tool for running Python apps in a sandboxed environment.
|
||||||
Version: edge0003-base0.2.1
|
Version: 0.2.1-next1
|
||||||
"""
|
"""
|
||||||
import os
|
import os
|
||||||
import time
|
import time
|
||||||
@@ -30,6 +30,8 @@ class PyJail:
|
|||||||
Runs a specified program.
|
Runs a specified program.
|
||||||
"""
|
"""
|
||||||
path_to_bin = self.fs(path_to_bin)
|
path_to_bin = self.fs(path_to_bin)
|
||||||
|
# print(path_to_bin)
|
||||||
|
# print(str(self.rootpath) + str(path_to_bin))
|
||||||
if path_to_bin == 3 or path_to_bin == 2:
|
if path_to_bin == 3 or path_to_bin == 2:
|
||||||
self.msg("jailmgr.run_program()", "An error has occurred launching the program.", True,
|
self.msg("jailmgr.run_program()", "An error has occurred launching the program.", True,
|
||||||
"WARNING")
|
"WARNING")
|
||||||
@@ -54,12 +56,10 @@ class PyJail:
|
|||||||
accepted_log_levels = ["DEBUG", "INFO", "WARNING", "ERROR", "CRITICAL"]
|
accepted_log_levels = ["DEBUG", "INFO", "WARNING", "ERROR", "CRITICAL"]
|
||||||
if log_level.upper() not in accepted_log_levels:
|
if log_level.upper() not in accepted_log_levels:
|
||||||
self.msg(f"jailmgr.msg()",f"Not accepted loglevel!! {log_level}", False, "ERROR")
|
self.msg(f"jailmgr.msg()",f"Not accepted loglevel!! {log_level}", False, "ERROR")
|
||||||
return 1
|
|
||||||
msg = f"[{time.time}] [{caller}] [{log_level}] {message}"
|
|
||||||
with open(self.fs("/proc/klog"), "a+") as f:
|
with open(self.fs("/proc/klog"), "a+") as f:
|
||||||
f.write(msg)
|
f.write(f"[{time.time}] [{caller}] [{log_level}] {message}")
|
||||||
if emit is True:
|
if emit is True:
|
||||||
print(msg)
|
print(message)
|
||||||
return 0
|
return 0
|
||||||
|
|
||||||
def fs(self, check_path=None, resolve_symlinks=True):
|
def fs(self, check_path=None, resolve_symlinks=True):
|
||||||
@@ -101,6 +101,7 @@ class PyJail:
|
|||||||
# This is a symlink!
|
# This is a symlink!
|
||||||
# Symlinks always contain the full literal path that they need to access, so we can
|
# Symlinks always contain the full literal path that they need to access, so we can
|
||||||
# take that and do the same trick to split it and add the next things to it.
|
# take that and do the same trick to split it and add the next things to it.
|
||||||
|
# raise NotImplementedError()
|
||||||
is_symlink_split = is_symlink.split(" ", 1)
|
is_symlink_split = is_symlink.split(" ", 1)
|
||||||
symlink_dest = is_symlink_split[1]
|
symlink_dest = is_symlink_split[1]
|
||||||
symlink_dest = f"{symlink_dest}/{path}"
|
symlink_dest = f"{symlink_dest}/{path}"
|
||||||
@@ -135,7 +136,7 @@ class PyJail:
|
|||||||
"""
|
"""
|
||||||
Returns the kernel version
|
Returns the kernel version
|
||||||
"""
|
"""
|
||||||
return "edge0003-base0.2.1"
|
return "0.2.1-next1"
|
||||||
|
|
||||||
def netsock(self, ip, port, mode, msg):
|
def netsock(self, ip, port, mode, msg):
|
||||||
"""
|
"""
|
||||||
@@ -150,44 +151,5 @@ class PyJail:
|
|||||||
Returns:
|
Returns:
|
||||||
Whatever the server returns.
|
Whatever the server returns.
|
||||||
"""
|
"""
|
||||||
if mode == "PKG":
|
raise NotImplementedError("TODO: Netsock will be implemented once 0.3.0 comes around!")
|
||||||
import requests
|
|
||||||
else:
|
|
||||||
import socket
|
|
||||||
|
|
||||||
if mode == "TCP":
|
|
||||||
try:
|
|
||||||
client_socket = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
|
||||||
except Exception as e:
|
|
||||||
self.msg("jailmgr.netsock()", "Socket import failed!", False, "CRITICAL")
|
|
||||||
self.msg("jailmgr.netsock()", "An unexpected error occurred!", True, "ERROR")
|
|
||||||
return None
|
|
||||||
# Connect to the server
|
|
||||||
client_socket.connect((ip, port))
|
|
||||||
self.msg("jailmgr.netsock()", f"Connected to server at {server_ip}:{server_port}", False, "INFO")
|
|
||||||
|
|
||||||
# Send the message to the server
|
|
||||||
client_socket.send(message.encode())
|
|
||||||
|
|
||||||
# Receive the response from the server
|
|
||||||
response = client_socket.recv(1024).decode()
|
|
||||||
client_socket.close() # Close the connection
|
|
||||||
self.msg("jailmgr.netsock", f"Received from server: {response}", False "INFO")
|
|
||||||
|
|
||||||
return response
|
|
||||||
|
|
||||||
elif mode == "PKG":
|
|
||||||
# raise NotImplementedError("TODO: PKG will be implemented later!")
|
|
||||||
file_io = requests.get(ip)
|
|
||||||
if file_io.startswith("PYPAK PMD"):
|
|
||||||
with open(self.fs(f"/usr/netsock/cache/{pkg}.pmd"), "a+") as f:
|
|
||||||
f.write(file_io)
|
|
||||||
f.close()
|
|
||||||
|
|
||||||
|
|
||||||
|
|
||||||
else:
|
|
||||||
raise NotImplementedError("TODO: UDP will be implemented later!")
|
|
||||||
|
|
||||||
# raise NotImplementedError("TODO: Netsock will be implemented once 0.3.0 comes around!")
|
|
||||||
|
|
||||||
|
6
sh.py
6
sh.py
@@ -1,6 +1,6 @@
|
|||||||
"""
|
"""
|
||||||
The shell for PyNVOS
|
The shell for PyNVOS
|
||||||
Version: 0.2.0.0400
|
Version: 0.2.0.0399
|
||||||
"""
|
"""
|
||||||
import importlib
|
import importlib
|
||||||
import os
|
import os
|
||||||
@@ -42,7 +42,7 @@ class shell(cmd.Cmd):
|
|||||||
|
|
||||||
def do_pkg(self, pkg):
|
def do_pkg(self, pkg):
|
||||||
"""Downloads packages over the internet."""
|
"""Downloads packages over the internet."""
|
||||||
self.jailmgr.netsock(f"https://pkg.novacow.ch/repo/{kver}/meta/{pkg}.pmd", None, "PKG", f"{pkg}")
|
self.jailmgr.netsock(f"https://pkg.novacow.ch/repo/{kver}/meta/{pkg}.pmd", 443, "PKG", "<null>")
|
||||||
shutil.copy(self.jailmgr.fs(f"/usr/netsock/cache/{pkg}.pmd"), self.jailmgr.fs(f"/usr/pkg/metacache/"))
|
shutil.copy(self.jailmgr.fs(f"/usr/netsock/cache/{pkg}.pmd"), self.jailmgr.fs(f"/usr/pkg/metacache/"))
|
||||||
with open(self.jailmgr.fs(f"/usr/pkgs/metacache/{pkg}.pmd"), "r") as f:
|
with open(self.jailmgr.fs(f"/usr/pkgs/metacache/{pkg}.pmd"), "r") as f:
|
||||||
package_meta = f.read()
|
package_meta = f.read()
|
||||||
@@ -52,7 +52,7 @@ class shell(cmd.Cmd):
|
|||||||
if y_n_confirmation.lower() != "y":
|
if y_n_confirmation.lower() != "y":
|
||||||
print("Aborted.")
|
print("Aborted.")
|
||||||
return
|
return
|
||||||
self.jailmgr.netsock(f"https://pkg.novacow.ch/repo/{kver}/main/static/binary/{pkg}.py", None, "PKG", f"{pkg}")
|
self.jailmgr.netsock(f"https://pkg.novacow.ch/repo/{kver}/main/static/binary/{pkg}.py", 443, "PKG", "<null>")
|
||||||
shutil.copy(self.jailmgr.fs(f"/usr/netsock/cache/{pkg}.py"), self.jailmgr.fs(f"/usr/bin/"))
|
shutil.copy(self.jailmgr.fs(f"/usr/netsock/cache/{pkg}.py"), self.jailmgr.fs(f"/usr/bin/"))
|
||||||
|
|
||||||
def postloop(self):
|
def postloop(self):
|
||||||
|
Reference in New Issue
Block a user