install edxapp code sandboxing

playbooks/roles/edxapp/defaults/main.yml

@@ -86,6 +86,16 @@ EDXAPP_LMS_BASIC_AUTH: False
 EDXAPP_CMS_BASIC_AUTH: False
 EDXAPP_LMS_PREVIEW_BASIC_AUTH: False
 
+# whether to setup the python sandbox or not
+EDXAPP_PYTHON_SANDBOX: false
+EDXAPP_SANDBOX_VENV_DIR:  '/opt/edx-sandbox'
+EDXAPP_SANDBOX_USER: 'sandbox'
+EDXAPP_SANDBOX_GROUP: 'sandbox'
+# this next setting, if true, turns on actual sandbox enforcement.  If not true,
+# it puts the sandbox in 'complain' mode, for reporting but not enforcement
+EDXAPP_SANDBOX_ENFORCE: true
+EDXAPP_USER: 'www-data'
+COMMON_WEB_GROUP: 'www-data'
 
 #-------- Everything below this line is internal to the role ------------
 
@@ -252,6 +262,8 @@ lms_preview_env_config:
 # install dir for the edx-platform repo
 edx_platform_code_dir: "{{ app_base_dir }}/edx-platform"
 
+# sandbox command
+edxapp_aa_command: "{% if EDXAPP_SANDBOX_ENFORCE %}aa-enforce{% else %}aa-complain{% endif %}"
 
 # gunicorn ports/hosts, these shouldn't need to be overridden
 edxapp_cms_gunicorn_port: 8010
@@ -274,6 +286,8 @@ service_variants_enabled:
 
 edxapp_lms_env: 'lms.envs.aws'
 
+edxapp_user: '{{ EDXAPP_USER }}'
+common_web_group: '{{ COMMON_WEB_GROUP }}'
 
 #Number of gunicorn worker processes to spawn, as a multiplier to number of virtual cores
 worker_core_mult:
@@ -304,9 +318,6 @@ sandbox_base_requirements:  "{{ edx_platform_code_dir }}/requirements/edx-sandbo
 sandbox_local_requirements: "{{ edx_platform_code_dir }}/requirements/edx-sandbox/local.txt"
 sandbox_post_requirements:  "{{ edx_platform_code_dir }}/requirements/edx-sandbox/post.txt"
 
-#do we want to install the sandbox requirements into the regular virtual env
-install_sandbox_reqs_into_regular_venv: true
-
 lms_debian_pkgs:
   # for compiling the virtualenv
   # (only needed if wheel files aren't available)

playbooks/roles/edxapp/tasks/deploy.yml

@@ -112,6 +112,7 @@
   command: |
     /bin/sed -i -e 's/github\.com/{{ GIT_MIRROR }}/g' {{ item }}
   with_items:
+    - "{{ base_requirements_file }}"
     - "{{ pre_requirements_file }}"
     - "{{ post_requirements_file }}"
     - "{{ repo_requirements_file }}"
@@ -191,7 +192,7 @@
   - "{{ sandbox_base_requirements }}"
   - "{{ sandbox_local_requirements }}"
   - "{{ sandbox_post_requirements }}"
-  when: install_sandbox_reqs_into_regular_venv
+  when: not EDXAPP_PYTHON_SANDBOX
   tags:
   - lms
   - cms
@@ -200,6 +201,51 @@
 
 - name: changing group ownership to www-data for everything in the venv (workaround)
   shell: chgrp -R www-data {{ venv_dir }}
+  tags:
+  - deploy
+
+# need to put this into complain mode, otherwise the pip inside the sandbox venv has no permissions
+# to install anything
+- name: disable apparmor profile for code sandbox
+  shell: "{{ item }}"
+  with_items:
+    - "ln -s /etc/apparmor.d/code.sandbox /etc/apparmor.d/disable/"
+    - "apparmor_parser -R /etc/apparmor.d/code.sandbox"
+  when: EDXAPP_PYTHON_SANDBOX
+  tags:
+  - deploy
+  - edxapp-sandbox
+
+- name: Install sandbox requirements into sandbox venv
+  shell: >
+    cd {{ edx_platform_code_dir }} &&
+    {{ EDXAPP_SANDBOX_VENV_DIR }}/bin/pip install -i {{ PYPI_MIRROR_URL }} --exists-action w --use-mirrors
+    --upgrade --no-deps -r {{ item }}
+  with_items:
+  - "{{ sandbox_base_requirements }}"
+  - "{{ sandbox_local_requirements }}"
+  - "{{ sandbox_post_requirements }}"
+  when: EDXAPP_PYTHON_SANDBOX
+  tags:
+  - deploy
+  - edxapp-sandbox
+
+- name: re-enable apparmor profile for code sandbox
+  shell: "{{ item }}"
+  with_items:
+    - "unlink /etc/apparmor.d/disable/code.sandbox"
+    - "apparmor_parser -r /etc/apparmor.d/code.sandbox"
+  when: EDXAPP_PYTHON_SANDBOX
+  tags:
+  - deploy
+  - edxapp-sandbox
+
+- name: put code sandbox into aa-enforce or aa-complain mode, depending on EDXAPP_SANDBOX_ENFORCE
+  command: /usr/sbin/{{ edxapp_aa_command }} /etc/apparmor.d/code.sandbox
+  when: EDXAPP_PYTHON_SANDBOX
+  tags:
+  - deploy
+  - edxapp-sandbox
 
 # https://code.launchpad.net/~wligtenberg/django-openid-auth/mysql_fix/+merge/22726
 # This is necessary for when syncdb is run and the django_openid_auth module is installed,

playbooks/roles/edxapp/tasks/main.yml

@@ -50,6 +50,59 @@
   - upstart
   - update
 
+- name: Create edxapp sandbox group
+  group: name={{ EDXAPP_SANDBOX_GROUP }}
+  when: EDXAPP_PYTHON_SANDBOX
+  tags:
+  - edxapp-sandbox
+
+- name: Create edxapp sandbox user
+  user: name={{ EDXAPP_SANDBOX_USER }} group={{ EDXAPP_SANDBOX_GROUP }} shell=/bin/false home={{ EDXAPP_SANDBOX_VENV_DIR }}
+  when: EDXAPP_PYTHON_SANDBOX
+  tags:
+  - edxapp-sandbox
+
+- name: Create edxapp sandbox virtual env directory
+  file: >
+    path="{{ EDXAPP_SANDBOX_VENV_DIR }}"
+    state=directory
+    owner=root
+    group=root
+    mode=0755
+  when: EDXAPP_PYTHON_SANDBOX
+  tags:
+  - edxapp-sandbox
+
+- name: Create edxapp sandbox virtualenv
+  command: /usr/local/bin/virtualenv {{ EDXAPP_SANDBOX_VENV_DIR }} --distribute creates={{ EDXAPP_SANDBOX_VENV_DIR }}/bin/activate
+  when: EDXAPP_PYTHON_SANDBOX
+  tags:
+  - edxapp-sandbox
+
+- name: Install apparmor system pkg
+  apt: pkg=apparmor-utils state=present
+  when: EDXAPP_PYTHON_SANDBOX
+  tags:
+  - edxapp-sandbox
+
+- name: write out apparmor code sandbox config
+  template: src=code.sandbox.j2 dest=/etc/apparmor.d/code.sandbox mode=0644 owner=root group=root
+  when: EDXAPP_PYTHON_SANDBOX
+  tags:
+  - edxapp-sandbox
+
+- name: write out sandbox user sudoers config
+  template: src=95-sandbox-sudoer.j2 dest=/etc/sudoers.d/95-{{ EDXAPP_SANDBOX_USER }} mode=0440 owner=root group=root
+  when: EDXAPP_PYTHON_SANDBOX
+  tags:
+  - edxapp-sandbox
+
+- name: start apparmor service
+  service: name=apparmor state=started
+  when: EDXAPP_PYTHON_SANDBOX
+  tags:
+  - edxapp-sandbox
+
 - include: npm.yml
 - include: ruby.yml
 - include: deploy.yml

playbooks/roles/edxapp/templates/95-sandbox-sudoer.j2

+{{ EDXAPP_USER }} ALL=({{ EDXAPP_SANDBOX_USER }})  SETENV:NOPASSWD:{{ EDXAPP_SANDBOX_VENV_DIR }}/bin/python
+{{ EDXAPP_USER }} ALL=(ALL) NOPASSWD:/bin/kill
+{{ EDXAPP_USER }} ALL=(ALL) NOPASSWD:/usr/bin/pkill

playbooks/roles/edxapp/templates/code.sandbox.j2

+#include <tunables/global>
+
+{{ EDXAPP_SANDBOX_VENV_DIR }}/bin/python flags=(complain) {
+    #include <abstractions/base>
+
+    {{ EDXAPP_SANDBOX_VENV_DIR }}/** mr,
+    {{ edx_platform_code_dir }}/common/lib/sandbox-packages/** r,
+    /tmp/codejail-*/ rix,
+    /tmp/codejail-*/** rix,
+
+    #
+    # Whitelist particiclar shared objects from the system
+    # python installation
+    #
+    /usr/lib/python2.7/lib-dynload/_json.so mr,
+    /usr/lib/python2.7/lib-dynload/_ctypes.so mr,
+    /usr/lib/python2.7/lib-dynload/_heapq.so mr,
+    /usr/lib/python2.7/lib-dynload/_io.so mr,
+    /usr/lib/python2.7/lib-dynload/_csv.so mr,
+    /usr/lib/python2.7/lib-dynload/datetime.so mr,
+    /usr/lib/python2.7/lib-dynload/_elementtree.so mr,
+
+    #
+    # Allow access to selections from /proc
+    #
+    /proc/*/mounts r,
+
+}
\ No newline at end of file