Sometimes, one needs to run tcl scripts in a secure environment. One of the ways to do this is to use the unix chroot() call to block out all access to the local file system. Since Tclkit is a static executable which carries a complete runtime with it, this is easy to do:
/*
* SafeKit - Running Tclkit inside a secure sandbox.
*
* This wrapper launches tclkit after calling "chroot()" to limit
* access to the filesystem to the current subtree. This approach
* guarantees that scripts run within this context cannot access a
* file outside this environment, not even through external programs.
*
* Since chroot can only be done by the superuser, this wrapper program
* has to be "setuid root". On startup, it does a chroot("."), and
* then reduces permissions to the original ones. Then, tclkit is
* launched, passing all arguments on to it.
*
* To use this sandbox, you need to place all scripts and data that
* are needed in a single directory area, along with a copy of tclkit
* and this safekit wrapper. Nothing else is needed, provided that
* tclkit and safekit are both compiled as fully static executables.
* If extensions are to be dynamically loaded, you will also need to
* create a /lib area with all necessary shared runtime libraries.
*
* For example, to run "myscript.tcl" safely, set up the following:
* $ ls -la
* total 3334
* drwxr-xr-x 2 jcw users 108 Apr 7 22:44 .
* drwxr-xr-x 8 jcw users 536 Apr 7 22:35 ..
* -rw-r--r-- 1 jcw users 126 Apr 7 22:37 myscript.tcl
* -rwsr-xr-x 1 root users 368376 Apr 7 21:57 safekit
* -rwxr-xr-x 1 jcw users 3035383 Apr 6 01:42 tclkit
* $
*
* The contents of "myscript.tcl" in the following example is:
* puts "pwd = [pwd]"
* catch { exec ls } err
* puts "exec ls -> [split $err \n]"
* puts "glob * -> [glob *]"
* cd ..
* puts "pwd = [pwd]"
*
* When run with a normal tclkit, this is the output:
* $ ./tclkit myscript.tcl
* pwd = /home/jcw/safexample
* exec ls -> myscript.tcl safekit tclkit
* glob * -> safekit tclkit myscript.tcl
* pwd = /home/jcw
* $
*
* When run through the safekit wrapper, it will be different:
* $ ./safekit myscript.tcl
* pwd = /
* exec ls -> {couldn't execute "ls": no such file or directory}
* glob * -> safekit tclkit myscript.tcl
* pwd = /
* $
*
* As you can see, there is no way out, and things like "ls" are not
* accessible.
*
* jcw, 07-04-2002
*/
#include <unistd.h>
#include <sys/types.h>
int main(int argc, char** argv)
{
if (chroot(".") != 0)
return 1;
if (seteuid(getuid()) != 0)
return 2;
argv[0] = "/tclkit";
if (execv(argv[0], argv) != 0)
return 3;
return 0;
}