Research On Sandbox For Python Application On PaaS Platform

Platform as a Service(PaaS) is a business model which use infrastructure platform as a service. PaaS provide platform enviroment to tenants, allow multi tenants deploy their cloud service in same time.As its openess and multitenancy, PaaS is faced with isolation problem: malicious tenant may destroy the platform or other tenant’s application.Now,PaaS platform support many languages,like Java,Python and others.In this paper,we analyse the security solution which aim at Python language on PaaS platform,consider they are coarse-grained and have low-compatibility, cause control policy is inflexible and cost high to migrate codes to PaaS platform.In this paper,we research on the security sandbox for python application on PaaS platform,to solve the isolation problem.We propose a sandbox named ’Opsandbox’which isolate and monitor the Python application in application framework layer.to provide fine-grained access control feature.And we use Container-based Operating System Virtualization:Linux Containers(LXC) to build a process-level sandbox in the meanwhile,to provide low level protection and support some resource quota feature.The main contribution and innovation in this paper include:1. Reserch on the presented solutions,such as Container-based Operating System Virtualization technique,seccomp sandbox,Simple Interpreter which proposed by Brett Cannon,the PyPy project which developed by Armin Rigo et.al,the RePy project which researched by Justin Cappos et.al,and the PyXhon project.And we analyse their advantages and disadvantages, think Container-based Operating System Virtualization technique, seccomp sandbox and PyXhon are coarse-grained, Simple Interpreter, PyPy and RePy have low-compatibility.2. Research and understand the operating principle of Python interpreter,mainly analyze the working manner of the Python execute engine,such as research some key structures(PyCodeObject,PyFrameObject),research on how to interpret the opcode,and research on the implementation of module mechanism,function mechanism,and memory management mechanism.3. Propose a sandbox named ’Opsandbox’ which fine-grained isolate and monitor the Python application in application framework layer.Opsandbox modify the compile result of Python program,inject instructure(opcode) sequence to them,make the Python program execute security check autonomously when they are running. Opsandbox doesn’t modify the interpreter or standard library, it is completely transparent to tenants, have high-compatibility. And it can apply different control policy to different code, is fine-grained.4. Reference the idea of multi-defense from AspectBox sandbox,use conainer-based virtualization technique:Linux Containers to build process level sandbox on PaaS platform,to protect platform in low level,and support some resource quota feature.In this paper,we describes the structure and implementation details of the sandbox, finally proves the effectiveness of this sandbox system through experiments.