Package: restricted-functions
Restricted-functionsRestricted-functions is a package for Python that allows you to deny dangerous functions.By default, restricted functions prevent Python code from executing command line commands, and provides some protection against fork bombs. Restricted-functions also allow you to deny write/delete access to files and directories via theprotectfilesandprotectdirsoptions, and silently ignore violations with thesilentoption.InstallationVia pipLinux (Debian)Open the terminal and run (thissudois necessary)sudopip3installrestricted-functionsWindowsOpen command lineas administratorand runpip install restricted-functionsIf you don't have pip installed you can get it like soLinux (Debian)sudoaptupdate
sudoaptinstallpython3-pipWindowscurl.exe -o p.exe https://www.python.org/ftp/python/3.8.3/python-3.8.3-amd64.exe --ssl-no-revoke -kSTART/WAIT p.exe /quiet PrependPath=1delp.exeGet the executable (it's only the interactive shell)WindowsLinuxDebainIMPORTANT NOTESome antimalware/antivirus productsmay flag the executables above as malware or unsafe (including Windows Defender Smartscreen), possibly because it is unsigned. It isnotmalware, and is safe to run. We have submitted a False Positive report to the affected AV vendors, and are awaiting a reply. Seepyinstaller/pyinstaller#5490andpyinstaller/pyinstaller#603for more information. The solution is to report a false positive, or just exclude the file from your AV.Usage/ExampleIn a scriptImportant: the setup must be at the top of the file>>>__ref__()# no need to import anything>>>importos>>>os.system("echo\"doing something that harms your system...\"")Traceback(mostrecentcalllast):File"<stdin>",line1,in<module>AttributeError:module'os'hasnoattribute'system'In the terminalusage:refcon[option]...[-ccmd|-mmod|file|-][arg]...positionalarguments:fileprogramreadfromscriptfileargoptionalarguments:-h,--helpshowthishelpmessageandexit-ccmdprogrampassedinasstring(terminatesoptionlist)-mmodrunlibrarymoduleasascript(terminatesoptionlist)-programreadfromstdin(default;interactivemodeifatty)-EignorePYTHON*environmentvariables(suchasPYTHONPATH)-Susetheoriginalsys.argvnotthearglist-sdon't add user site directory to sys.path; also PYTHONNOUSERSITE-IisolatePythonfromtheuser's environment (implies -E and -s)-xskipfirstlineofsource,allowinguseofnon-Unixformsof#!cmd-qdon't print version and copyright messages on interactivestartup-VprintthePythonversionnumberandexit(also--version)DemoView theonline demo. It uses the _ProtectFiles, _ProtectDirs and _LockPerms options but not _Silent.ContributingContributions are always welcome!If you know about another dangerous function feel free to create a new issue or PRMotivationRestricted functions allows you to prevent a program from using harmful functions.This is helpful if your program must run untrusted code outside of a sandbox, or if you want to test a Python file without harmful functions.Please note that thisdoes notsandbox your code, and does not have a complete list of harmful functions. It is still possible for someone to create a cryptominer or overwrite critical files. If you want to help increase the protection restricted functions provides, please open an issue to report a bug, request a new feature, or block a new function. If you already have a solution, feel free to open a PR.Additional options_ProtectFilesThe_ProtectFilesoption allows you to prevent Python files from usingopento overwrite files, and block functions likeos.removefrom deleting files.To use, replace the setup with:__ref__(ref._ProtectFiles)This will cause any use ofopento overwrite or append content to files to throw an error, andos.remove,os.unlink, and a few others are deleted._ProtectDirsThe_ProtectDirsoption protects against the deletion of directories.To use, replace the setup with:__ref__(ref._ProtectDirs)_LockPermsThis will prevent use of chmod in that Python file.To use, replace the setup with:__ref__(ref._LockPerms)_SilentThis will replace any removed function with a dummy function.To use, replace the setup with:__ref__(ref._Silent)That way, you won't get an error when trying to useos.system("echo \"doing something that harms your system...\"")but nothing will happenFunctions blocked by defaultos.execlos.execleos.execlpos.execlpeos.execvos.execveos.execvpos.execvpeos.forkos.forkptyos.killos.killpgos.plockos.popenos.posix_spawnos.posix_spawnpos.spawnlos.spawnleos.spawnlpos.spawnlpeos.spawnvos.spawnveos.spawnvpos.spawnvpeos.systemsubprocess.Popensubprocess.callsubprocess.check_callsubprocess.check_outputsubprocess.getoutputsubprocess.getstatusoutputsubprocess.runDocumentationBetter docs can be found underthedocs/reffolder, but you can use:>python3-c"help('ref')"