Running DLR Embedded Scripts in Minimum Security Context

Question

I need to get pointed in the right direction. I have embedded an Iron Python scripting host into a simple C# application, but now I need to know the best practices for locking down security on a user generated IronPython or IronRuby script.

Specifically, what are the strategies for preventing library imports and isn't there a way in .NET to run a block of code or a thread in a different security context, for instance to prevent file system access? Also, can this context be assigned a built-in level or role rather than an actual user?

Thanks!

Sergey Mirvoda · Accepted Answer · 2010-02-28 17:20:36Z

5

You should run scripting host in different appdomain, and setup Security Policies via Evidence property using sandboxing API

edited Feb 28, 2010 at 17:20

answered Feb 28, 2010 at 14:52

Sergey Mirvoda

3,2392 gold badges29 silver badges31 bronze badges

Sign up to request clarification or add additional context in comments.

4 Comments

Josh Pearce Over a year ago

Sergey, Would that prevent an IronPython open('c:\\file.txt') call?

Sergey Mirvoda Over a year ago

not sure about Python, but if it opens file using System.IO namespace definitely yes.

Josh Pearce Over a year ago

I guess you're an IronRuby guy. Would a locked down AppDomain prevent ruby's native file methods from working?

Shay Friedman Over a year ago

Of course! remember that IronRuby's native file methods are eventually System.IO operations.

Collectives™ on Stack Overflow

Running DLR Embedded Scripts in Minimum Security Context

1 Answer 1

4 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

4 Comments

Your Answer

Sign up or log in

Post as a guest

Related