Which security measures are implemented by cloud platforms that permit submitting Python code to be executed remotely?

Question

Which security measures are implemented by cloud platforms that permit submitting Python code to be executed remotely? I can think of a few examples:

• user access control
• resource allocation
• job queue monitoring
• static code analysis
• sandboxing

What other measures may be taken to prevent users from executing malicious code?

Answer 1

The most important measure is certainly sandboxing. Different services will use different techniques for this, but there are some standard approaches which can be layered to provide reasonable security.

• To isolate the component which compiles and/or runs the code from the rest of the system, it's a good idea to keep that component in a virtual machine or container.
• Since this isolation can fail (due to bugs or misconfiguration) and allow an attacker to break out of the VM or container, access control systems like SELinux may be used. For example, there's sVirt which applies SELinux to KVM.
• Inside of the VM, the component running the code can also be restricted through SELinux.
• When it comes to running the code, it is possible to intercept system calls with something like ptrace and prevent the program from directly accessing the filesystem, opening network sockets or performing other unwanted actions. For example, there's Google's Sandbox2 which implements this approach.

Limiting CPU and RAM usage is also a good idea.

Static analysis in an attempt to detect malicious code is too brittle. You may be able to catch some obvious attacks, but no malware scanner is perfect.