Raynes / clojail

A control freak's best friend
Eclipse Public License 1.0
213 stars 27 forks source link

Allow createTempFile inside clojail #14

Open nivemaham opened 8 years ago

nivemaham commented 8 years ago

Hi there, I am using clojail in my application to securely evaluate custom code. I want to allow my application to process some excel files(xlsx). The libraries i use ended up using Java's createTempFile API. I get following exception.

Caused by: java.lang.SecurityException: Unable to create temporary file
    at java.io.File.createTempFile(File.java:2018)
    at java.io.File.createTempFile(File.java:2070)
    at org.apache.xmlbeans.impl.common.XBeanDebug.log(XBeanDebug.java:97)
    at org.apache.xmlbeans.impl.common.XBeanDebug.logException(XBeanDebug.java:116)
    at org.apache.xmlbeans.impl.schema.SchemaTypeSystemImpl.<init>(SchemaTypeSystemImpl.java:189)
... 60 more

How can i customize my clojail sandbox to allow creating temp files? This is how i am creating a sandbox now.

(defn getExcelLogPath []
  (let [temp (System/getProperty "java.io.tmpdir")
        xmlLogPath (str temp "xmlbeandebug.log")]
    temp
    )
  )
(defn build-sandbox
  [ file-path]
  (let [context (-> (permissions (FilePermission. file-path "read")
                                 (PropertyPermission. "file.separator" "read")
                               ;  (FilePermission. (getExcelLogPath) "read")
                               ;  (FilePermission. (getExcelLogPath) "write")
                                 ;(PropertyPermission. "java.io.tmpdir" "read, write")
                               )
                    domain
                    context)
        namespace-form (namespace-declaration)
        sb (sandbox modified-secure-tester-without-def
                    :init namespace-form
                    :context context
                    :transform eagerly-consume
                    :timeout (* 5 60 1000) ;; 5 minute timeout
                    :max-defs 500)]
    (log/log-env :info "build-sandbox")
    sb))

Please provide me some help on this.