How to limit the capabilities of lua (calling OS functions, modules, etc.)

Question

I use Lua as a script language inside my C application.

This is very suitable for me, but I can’t understand how I can limit Lua not to call system functions, not include other modules, etc.

I want Lua to be able to call only functions that are allowed by me, because the user can do all kinds of bad things with the full power of Lua + Lua modules.

Answer 1

Take a look at Simple Sandbox on the Lua wiki user: http://lua-users.org/wiki/SandBoxes

Related SO Discussions:

• Is there anyway to avoid this security issue in Lua?
• How to create a secure Lua sandbox?
• How to execute untrusted Lua file in native environment from C API

Answer 2

The sandbox is the term you are looking for. In short, just export to Lua the functions you want users to call. It is simple, really.

Answer 3

You can accomplish this without loading the os or package modules. Instead of luaL_openlibs , see this post .