DIsable Python Module

Question

Is there a way to disconnect a module from loading on my system? Let's say I would like to restrict my users access to the subprocess or popen2 module. Something like PHP 'disabled_functions' or any similar method to achieve the same.

Answer 1

As @Thomas notes, blacklisting is a pretty poor mechanism for implementing any security mechanism. Whitelisting is a much safer approach.

But the mechanism inside the interpreter is not particularly excellent for a number of reasons: flaws in the interpreter that can be used at the source code level will allow users to bypass all the mechanisms built at this level (and the PHP team asked Linux vendors to stop calling this security problem because ( a) they fixed one of them every week and (b) try to limit the script to an unreliable supply by the user - it is an almost impossible task to use FastCGI or similar tools for potentially untrusted scripts).

The Python interpreter is probably not designed to handle malicious input, so don't treat it as such.

If you really want to limit what unreliable users can do with Python scripts, a few tips: don't use mod_python or anything like that. Use FastCGI or similar tools that allow you to specify the user account that should run the script, and will not execute the script as a web server user. And learn how to configure SELinux or AppArmor to limit what this process can do - setting up one of these tools for hours can save you huge headaches in the future, plus you can laugh at all the cute unsuccessful exploit attempts that don't work.