3

I want to create a Java-based website that will execute completely untrusted code from third parties. This third-party code will need to be able to access websites on the Internet, but not, for example, attempt a DoS on them.

I can choose the language, but if its obscure it will hurt adoption of the service I'm building.

Can anyone provide some pointers as to open source tools I should investigate?

sanity
  • 35,347
  • 40
  • 135
  • 226
  • How might the JVM prohibit a DoS while still granting the code access to the Internet? Code either has a given permission, which means it will be able to do *everything* the permission allows, or it hasn't. – ignis Jun 03 '11 at 02:08
  • Is that (third-party) code open-source? In this case I think you do not have to consider it untrusted – ignis Jun 03 '11 at 02:11
  • Perhaps the operating system can give some solutions. In Linux for instance one can create a virtual user, and run the program in his userspace. This prevent access to user data, and still gives some resources (internet connection) to the program. Otherwise running the program inside a virtual machine (with a virtual hard drive containing no data) could be a solution. But I' not familiar with these technologies. – Willem Van Onsem Jun 03 '11 at 02:17
  • 1
    Actually Java has a nice policy mechanism which allows some given code to access, say, user data on the local filesystem, while not being able to access the Internet. Package java.security – ignis Jun 03 '11 at 02:19
  • same for Linux no language specified: http://stackoverflow.com/questions/792764/secure-way-to-run-other-people-code-sandbox-on-my-server – Ciro Santilli OurBigBook.com Aug 05 '14 at 21:43

5 Answers5

1

Are you thinking of something like the Google App Engine? They do this for Java by providing a "sandbox" where the app has access only to carefully restricted subset of the Java API. You might take a look at their JRE White List for ideas. (They also provide other languages.)

Yahoo App Platform and Amazon Web Services provide similar functionality, but not in Java (which, from your tag, I assume is your main interest).

Ted Hopp
  • 232,168
  • 48
  • 399
  • 521
1

The key to do this with Java code, of course, is defining a SecurityManager and then carefully specifying the policy. Aside from that, you'd host on a Linux system and use a chroot jail -- or better yet, a chroot jail on a virtualized system.

You don't have to worry about someone using your single server to launch a DDOS attack, though, by definition!

Ernest Friedman-Hill
  • 80,601
  • 10
  • 150
  • 186
1

First things first, you need to build an excellent jail or sandbox for your application. Virtualization can help, but even within a guest VM there are a lot of operations you wouldn't want your untrusted code to perform.

So investigate mandatory access control such as AppArmor, SElinux, TOMOYO, or SMACK. Any of these can lock down your server code to only a subset of allowed operations. There are patches available that can lock your application to a subset of system calls that is probably worth investigating as well. (Since I've worked on AppArmor for almost a decade, it's the tool I know best. It's also the tool I think best suited for the task, but SMACK's utter simplicity is really appealing.)

You can perform rate limiting at the firewall level to try to limit the amount of outside annoyances that your code hosting can cause. Rate limiting isn't the same as preventing :) but it gives you an opportunity to see obvious attempts to do stupid things in your logs.

sarnold
  • 102,305
  • 22
  • 181
  • 238
0

I'm not sure if I understand your question. But from what I understand you just need the user to be able to execute code (in a java-based website, however the code doesn't need to be java), in that case have you considered letting the user execute only client-side code (ie javascript)? This way the only machine they can harm is their own. You can read more about how other websites handle malicious code here and you can read about the few dangers of letting users execute JS here.

Community
  • 1
  • 1
Tomas Reimers
  • 3,234
  • 4
  • 24
  • 37
0

Wait you all.

There is no reason for @sanity to look for 3rd party solutions, because Java already has a policy mechanism which allows untrusted code to access only a given subset of the Java API. See package java.security and SecurityManager. It allows you to say the JVM, "this app must have permission to access this stuff but not this other one".

But I think @sanity wants to grant a given permission to run untrusted code, without allowing it to do harmful things with that permission...

ignis
  • 8,692
  • 2
  • 23
  • 20
  • 1
    No. Restricting library access will not prevent untrusted code from allocating huge amount of memory or using huge amount of CPU cycles, and eventually crash down your server. This should not be the accepted answer. – coffee_machine Jul 25 '14 at 15:38