Sandman

A container for running untrusted(-ish) Node.js programs.

If you're in any kind of multi-tenant environment where you're automatically running Node.js written by other people, or using modules that you haven't seen ahead of time, just running them is quite dangerous - even accidentally. A malicious (or poorly written) module would have access to your environment variables, any files that Node has access to, and can start programs and connect to outside servers.

If you have a multi-tenant environment purely for hosting Node.js to be executed (a la Heroku), containerization and virtual machines are a much better solution. But if untrusted Node.js is a small side effect of your application, Sandman provides a comparatively simple and low overhead way to execute code.

Usage

Basic Usage

entrypoint.js

var untrusted = require('untrusted');

module.exports = function (arg1, arg2, callback) {
  var myValue = untrusted(arg1, arg2);

  callback(null, myValue);
};

runner.js

var Sandman = require('sandman');

Sandman.run('./entrypoint.js', '/path/to/safe/root', [arg1, arg2], function (err, myValue) {
  if(err) throw err;

  console.log(myValue); // outputs the result of `untrusted(arg1, arg2)`
});

When you run Sandman on your entrypoint file, it will call the resulting module.exports with your arguments and a callback. Call the callback when you've run your untrusted modules.

Advanced Usage

Constructor

You can have more control over the Sandman instance by using the constructor:

var sandman = new Sandman("./entrypoint.js", "/some/safe/root");

The Sandman instance exposes the following properties and methods:

• interface a ChildProcess connected to the Sandman client. This can be used to send messages and sockets to your entrypoint file.
• run - Start the entrypoint file. Called with an array of arguments and a callback.
• _onMessage - Listens for message from the client. Change it before calling run.
• _onError - Listens for error from the client. Change it before calling run.
• _onExit - Listens for exit from the client. Change it before calling run.

Client

Within the entrypoint file, you can access the client by doing:

var sandmanClient = require('sandman')

The Sandman Client exposes the following methods and properties:

• arguments array of arguments called on Sandman#run. (these are applied to the entrypoint file's module.exports function)
• callback Callback to be called when the entrypoint file is done. (this is the last argument supplied to the entrypoint file's module.exports function)
• root the secure root that Sandman was called in
• filename the entrypoint file name. (this is also available on the global scope in __filename)
• interface An alias for process, this is used to communicate with the Sandman constructor via Client#interface.send
• sendError A sugary method for sending errors to the Sandman constructor (used internally when callback's first parameter is an error)

Be warned - do not pass the client to any untrusted code - it probably has everything you need to break out of the jailed environment in a hot second.

About

Security

This isn't truly secure, and there likely isn't a way to make Node.js secure at the application level (See this discussion). Instead, this module provides a way to execute Node.js code that should prevent against most kinds of bad stuff, intentional or unintentional.

Features

• Operates in a new process, and every module in its own context
• No fs access outside the defined root, except files within a node_modules directory
• Cannot change the current working directory to be outside of root
• Cannot change uid or gid
• Timeout to kill runaway processes
• Cannot require files outside of root, except fiels within a node_modules directory
• No access to dangerous core modules:
  • child_process
  • cluster
  • http
  • https
  • net
  • tls
  • dgram
  • repl

The key difference between Sandman and most other sandboxing libraries is that the entire dependency chain is contained. So, for example, requiring fs-extra, which in turn requires fs will not get you outside the sandbox.

Limitations

The most obvious limitation is the attack surface area - there are almost certainly ways to exploit this kind of sandboxing, so don't rely on it for anything super important.

Most specifically, for reasons of practicality and interop with npm, require and fs calls are not limited to root when the requested file is inside of a node_modules directory. This should be fine in most cases, as published modules shouldn't contain anything sensitive, but it certainly opens up a potential attack vector.

The other limitation is one of speed and memory. Each Sandman instance creates a new process, and each dependency is put in a new context. This is much lower overhead than OS level sandboxing, but you obviously can't have tons of these (i.e. thousands) on a single machine.