xrymbos/nztrain-v2 — Issue #10: Evaluator Security
Author: ronalchn
Created: 2012-01-28 23:05:32+00:00
State: open

I checked the evaluator code, and it just runs the evaluator script.

This means that anybody who can add an evaluator might add a malicious script which could do anything.

We should sandbox the evaluator as well. Found something which might be useful.

http://ftp.netbsd.org/pub/NetBSD/packages/pkgsrc/mk/bulk/mksandbox