Restrict the Python file to read and write-CodePudding

I'm trying to restrict write and read access to a Python file. Suppose I have the following code:

with open('test.py', 'w ') as file:
    file.write('''
open("document.txt", "w ").write("Hello, World!")
open("document.txt", "r ").read()
''')

By executing this code, a new file is created that in the new file there are two lines of code to write and read a another file. I want the file created by executing this code (test.py) to hit PermissionError while running and not be able to create a new file or read it; Also, this file is only executable and normal commands work in it, but it can not access other files.

CodePudding user response：

If I read you correctly, this is not a python problem, but an environment problem. I understand the question as something like 'how do I prevent python code from executing arbitrary reads or writes?'. There would be a trivial solution (modifying the generated test.py so it throws an error) but presumably that's not what you want.

The easiest way to make python hit a PermissionError... is to make sure it doesn't have permissions. So run your code as a user with extremely limited permissions---specifically no write permissions anywhere---or perhaps no default permissions at all, and use something like facls to grant permission to read specific files explicitly from a more priveleged sentinel process. (This assumes you are running Linux, but there are likely other ways to do this in different OSs).

Alternatively, look into various sandboxing techniques to give you a python interpreter with the relavent modules replaced with modules which throw errors, or an environment where outside modification is impossible.

It would help if you made it clearer why this is important, and why you are writing a python script with another python script (is this just an example of malicious action?).

CodePudding user response：

You could technically change the permission of the file itself on the filesystem your trying to access.

Check the previous thread about changing permissions

os.chmod(path, <permission value>)

Where 000 is to disable anyone other than root to edit on linux.