Sandbox plugins
I am planning to write a pluggable application in python (+ qt4). However, I am very concerned about security. Plugins need to be powerful enough to do what they like about the application (and as an additional constraint there will be a signing process and a warning to the user when using such a plugin), but interactions with the environment (filesystem, other processes, networks, etc.) should be done by plugins only through some python code that I'll write.
Is there any safe and easy way to achieve it, besides having to do static code analysis in the plugins code before installing them?
a source to share
In short: No.
Explanation: Python gurus have been trying to create a sandbox for Python for years. The problem with sandboxing is that you need to do multiple I / O operations (i.e., be able to transfer data between the sandbox and the application). They didn't find an automatic, pythonic way to do it. Or, you cannot exchange data with the plugin or introspection, then allow walking through the tree of objects in the application → access to whatever you like.
Imagine your idea: the plugin calls some python code that you write. This probably means calling a method or function. This means you have to give me a valid method or function object. From a method or function object, I can get a module object. From your module, I can get all symbols (i.e. Import). From there, I can do whatever your module (at least) can do.
See the article for some pointers.
a source to share
Python code running in a regular Python process cannot be isolated as you can always scan, but you can isolate the entire Python interpreter.
For example, PyPy supports sandboxing: http://codespeak.net/pypy/dist/pypy/doc/sandbox.html
If you'd like, perhaps you could write a python library to run a python script in a protected pypy-c instance with some shared memory used to pass data you trust and some signals to trigger events in your program.
You might also be able to handle a normal built-in cpython interpreter using something like selinux which I believe can be used in code (usually a sysadmin) and is supported on most Linux distributions or whatever Windows alternative depends from your platform. Google Chrome has sandboxed code if you're willing to dig, though it's a giant codebase.
a source to share