Skip to content

[269] Extend safety of Python rule execution (4-3-stable) #271

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
korydraughn merged 1 commit into from
Sep 17, 2026
Merged

[269] Extend safety of Python rule execution (4-3-stable) #271

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
76 changes: 51 additions & 25 deletions src/main.cpp
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -245,6 +245,38 @@ namespace
return rei;
}

irods::error require_privileged_user_for_python_execution(const ruleExecInfo_t& rei, const char* operation)
{
int client_user_authflag = 0;
if (rei.rsComm) {
client_user_authflag = rei.rsComm->clientUser.authInfo.authFlag;
}
else if (rei.uoic) {
client_user_authflag = rei.uoic->authInfo.authFlag;
}

int proxy_user_authflag = 0;
if (rei.rsComm) {
proxy_user_authflag = rei.rsComm->proxyUser.authInfo.authFlag;
}
else if (rei.uoip) {
proxy_user_authflag = rei.uoip->authInfo.authFlag;
}

if ((client_user_authflag < REMOTE_PRIV_USER_AUTH) || (proxy_user_authflag < REMOTE_PRIV_USER_AUTH)) {
// clang-format off
log_re::debug({
{"rule_engine_plugin", rule_engine_name},
{"operation", operation},
{"log_message", "Insufficient privileges to execute Python rule text"},
});
// clang-format on
return ERROR(SYS_NO_API_PRIV, "Insufficient privileges to execute Python rule text");
}

return SUCCESS();
} // require_privileged_user_for_python_execution

// Helper struct for managing python thread state
struct python_thread_state_scope
{
Expand Down Expand Up @@ -702,30 +734,8 @@ static irods::error exec_rule_text(const irods::default_re_ctx&,
return ERROR(NULL_VALUE_ERR, "Null rei pointer in exec_rule_text");
}

int client_user_authflag = 0;
if (rei->uoic) {
client_user_authflag = rei->uoic->authInfo.authFlag;
}
else if (rei->rsComm) {
client_user_authflag = rei->rsComm->clientUser.authInfo.authFlag;
}

int proxy_user_authflag = 0;
if (rei->uoip) {
proxy_user_authflag = rei->uoip->authInfo.authFlag;
}
else if (rei->rsComm) {
proxy_user_authflag = rei->rsComm->proxyUser.authInfo.authFlag;
}

if ((client_user_authflag < REMOTE_PRIV_USER_AUTH) || (proxy_user_authflag < REMOTE_PRIV_USER_AUTH)) {
// clang-format off
log_re::debug({
{"rule_engine_plugin", rule_engine_name},
{"log_message", "Insufficient privileges to run irule in Python rule engine plugin"},
});
// clang-format on
return ERROR(SYS_NO_API_PRIV, "Insufficient privileges to run irule in Python rule engine plugin");
if (const auto err = require_privileged_user_for_python_execution(*rei, "exec_rule_text"); !err.ok()) {
return err;
}

try {
Expand Down Expand Up @@ -882,6 +892,23 @@ static irods::error exec_rule_expression(irods::default_re_ctx&,
msParamArray_t* ms_params,
irods::callback effect_handler)
{
// Because Python is not sandboxed, need to restrict execution of Python text to admin users only.
const auto rei = get_rei_from_effect_handler(effect_handler);

if (!rei) {
// clang-format off
log_re::error({
{"rule_engine_plugin", rule_engine_name},
{"log_message", "RuleExecInfo object is NULL - cannot authenticate user"},
});
// clang-format on
return ERROR(NULL_VALUE_ERR, "Null rei pointer in exec_rule_expression");
}

if (const auto err = require_privileged_user_for_python_execution(*rei, "exec_rule_expression"); !err.ok()) {
return err;
}

try {
std::lock_guard<std::recursive_mutex> lock{python_mutex};
python_thread_state_scope tstate;
Expand Down Expand Up @@ -945,7 +972,6 @@ static irods::error exec_rule_expression(irods::default_re_ctx&,
bp::exec(fcn_text.c_str(), main_namespace, main_namespace);
bp::object rule_function = main_module.attr(rule_name.c_str());

const auto rei = get_rei_from_effect_handler(effect_handler);
bp::list rule_arguments_python{};
return to_irods_error_object(rule_function(rule_arguments_python, CallbackWrapper{effect_handler}, rei));
}
Expand Down
Loading