How can I do an advanced management of PyModules

[jmwielandt]

Hi, we're trying to do a sandboxing of python code within python, with a thin layer of Rust as a glue. In particular we want to have multiple python files and load them into python (passing through rust) in a sandbox-like environment (no access to os, sys, importlib, __import__, eval, exec and open, at least), inject dependencies to them (other python modules) and replicate them between multiple instances of our "big sandbox". At the same time, developers should be able to run those python files outside the sandbox normally.

Searching on the internet I couldn't find anything related to what I wanted to do.

Examples of my desires:

#[pyfunction]
fn empty_module<'py> () -> PyResult<&'py PyModule> {

    let gil = Python::acquire_gil();
    let py = gil.python();
    let modref = PyModule::new(py, "holi")?;
    
    Ok(modref)  // I can't return bc it's referencing local gil.
}

#[pyfunction]
fn get_gil() -> GILGuard{
    Python::acquire_gil()
} // the trait `pyo3::callback::IntoPyCallbackOutput<_>` is not implemented for `pyo3::GILGuard`rustc(E0277)

#[pyfunction]
fn import_view<'py>(
    gil: &'py GILGuard, // the trait `pyo3::PyClass` is not implemented for `&pyo3::GILGuard`
    name: &str,
    dependencies: Vec<&PyModule>,
    code: &str,
) -> PyResult<&'py PyModule> {
    let py = gil.python();

    let module = PyModule::new(py, name)?;

    for dpendency in dependencies {
        module.add_submodule(dpendency)?;
    }
    // I want to add code to the module
    // so my imports won't fail
    //
    // ... and I can override "os" with an
    // empty module so is no usable

    Ok(module)
}

Is there a way to do such a thing?
Thanks!

[davidhewitt]

I think you want:

#[pyfunction]
fn empty_module<'py> (py: Python<'py>) -> PyResult<&'py PyModule> {

and

#[pyfunction]
fn import_view<'py>(
    py: Python<'py>,
    name: &str,
    dependencies: Vec<&PyModule>,
    code: &str,
) -> PyResult<&'py PyModule> {

You can always take Python as an argument to the #[pyfunction] - this argument doesn't really exist on the Python side, and PyO3 will fill it in for you.

For get_gil, perhaps taking py: Python removes the need for it?

[jmwielandt]

Thanks!!
And, is there a way to add code (&str) to an existent instance of PyModule? That was my second problem yesterday ^^u

[davidhewitt]

Hmm, I've not tried to do this myself. You might be able to use Python::run with the module's dict as the locals argument.

[jmwielandt]

Hmm, I've not tried to do this myself. You might be able to use Python::run with the module's dict as the locals argument.

I'm trying sth like this:

let globals = module.dict().get_item("__builtins__").unwrap().get_item("globals").unwrap().call0()?.downcast::<PyDict>()?;
let locals = module.dict().get_item("__builtins__").unwrap().get_item("locals").unwrap().call0()?.downcast::<PyDict>()?;
py.run(code, Some(globals), Some(locals))?;

But the module's globals/locals aren't modified.

Then, if I try

    for py_pair in locals.items().iter() {
        let py_tuple = py_pair.downcast::<PyTuple>()?;
        let key = py_tuple.get_item(0)?.downcast::<PyString>()?.to_str()?;
        let value = py_tuple.get_item(0)?;
        module.add(key, value)?;
    }

It doesn't propperly adds local's content to my module's scope. For example, in my code I define a function called "render", but what is added to the dict under that key is Some("render") instead of the function.

[davidhewitt]

let value = py_tuple.get_item(0)?;

Looks like you're accidentally using the key again as the value.

[mejrs]

Hi, we're trying to do a sandboxing of python code

pyo3 is not meant for sandboxing. If you want to run untrusted python code, you cannot use pyo3 to do that.

(no access to os, sys, importlib, import, eval, exec and open, at least)

This approach doesn't work, there are many, many other things an attacker can use to break out of a simple sandbox like that.

Perhaps Lua would work better for you? It is more focused towards being ran in sandboxes.

[jmwielandt]

pyo3 is not meant for sandboxing. If you want to run untrusted python code, you cannot use pyo3 to do that.

That's not the case. Is trusted code, but we need to protect scopes.
What we want is to embed remote python code in a python application in execution time.
Yep, its a really weird use case, but is justified XD