Prev: sagittal slice from a txt file
Next: Transfer function matrix using symbolic math toolbox
From: Jan Sieber on 25 Feb 2010 17:46
This is a teaching related question:

I want to test automatically Matlab functions written by students using a Matlab script. I can easily catch errors with try/catch but how can I prevent from exexcution malicious code such as system calls or access to caller workspace inside the tested function? I have not found anything in the help about this topic.

At the moment, my resort is to run these tests calling Matlab as a different user but this is impractical because then I cannot run Matlab under my original name anymore (licensing restriction).

Any help would be appreciated,
Jan
From: Jan Simon on 26 Feb 2010 12:22
Dear Jan Sieber!

> I want to test automatically Matlab functions written by students using a Matlab script. I can easily catch errors with try/catch but how can I prevent from exexcution malicious code such as system calls or access to caller workspace inside the tested function? I have not found anything in the help about this topic.
>
> At the moment, my resort is to run these tests calling Matlab as a different user but this is impractical because then I cannot run Matlab under my original name anymore (licensing restriction).

To be exact: You have no chance to create a perfect sandbox in Matlab.
E.g. this showed us, that you can even get admin privilegs from inside Matlab:
http://www.mathworks.com/matlabcentral/newsreader/view_thread/269939

My advice is trivial: If you are the teacher, look into the source code of your students.
1. You can find EVAL, SYSTEM, DOS and UNIX commands.
2. You can correct or improve the source code to teach the students how to write clean and efficient programs.
3. Tell your students, that submitting malicious programs to a teacher will provoke serious consequences. On my University (Heidelberg, Germany) this would be a reason to remove somebody from the register of students and it is a destruction of a public property and therefore a case for the public prosecutor.

Another idea is to create M-files with the above names, which shadow the original functions.

Good luck, Jan
From: James Tursa on 26 Feb 2010 14:09
"Jan Simon" <matlab.THIS_YEAR(a)nMINUSsimon.de> wrote in message <hm8vvq$s5o$1(a)fred.mathworks.com>...
>
> Another idea is to create M-files with the above names, which shadow the original functions.

But that doesn't catch the builtin calls. Maybe also overload the builtin function? But even here, I doubt you would be able to catch a persistent malicious coder in a foolproof manner.

James Tursa
From: Jan Simon on 26 Feb 2010 14:27
Dear James!

> > Another idea is to create M-files with the above names, which shadow the original functions.
>
> But that doesn't catch the builtin calls. Maybe also overload the builtin function?

Do you mean:
builtin('system', ...)
Correct, I forgot this. And FEVAL combined with CD to the corresponding directories. I do not know how to overload "!" - this is perhaps a sandbox killer?

> But even here, I doubt you would be able to catch a persistent malicious coder in a foolproof manner.

I agree. So a good sandbox would be a virtualized computer which returns to its previous status on each reboot. Or even better: Send students, who have the intention to deliver malicious code, to a real world 3D sandbox.

Good luck, Jan
From: Oleg Komarov on 26 Feb 2010 14:45
us FEX submission fdep dissect an .m file to find all kind of dependencies...
give it a look:
http://www.mathworks.com/matlabcentral/fileexchange/17291-fdep-a-pedestrian-function-dependencies-finder

Oleg
 |  Next  |  Last
Pages: 1 2 3
Prev: sagittal slice from a txt file
Next: Transfer function matrix using symbolic math toolbox