Is there a "safe" subset of Python for use as an embedded scripting language?

Question

In the many Python applications I've created, I often create simple modules containing nothing but constants to be used as config files. Additionally, because the config file is actually a Python code file, I can add simple logic for changing variables depending on a debug level, etc.

While this works great for internal applications, I'd be wary about releasing such applications into the wild for fear of someone either accidentally, or maliciously, adding destructive code to the file. The same would hold true for using Python as an embedded scripting language.

Is there a subset of Python that is deemed "safe" for embedding? I realize how safe it can be considered is fairly subjective. However, Java Applets and Flash both have their security sandbox well defined. I'm wondering if there's a version of Python that has similar rules?

EDIT: I'm asking not so much because of the config file approach, but because I'm interested in implementing some scripting/plugin mechanisms into a newer app and don't want a plugin or script to be able to, say, delete files. That goes beyond the scope of what the application should be able to do.

Answer 1

Here are a couple of links to give you an idea on what you're up against:

• How can I run an untrusted Python script safely (i.e. Sandbox)
• Capabilities for Python? by Guido himself

There is also a dead google code project at http://code.google.com/p/sandbox-python/

Answer 2

The PyMite VM fits the bill if all you need to do is set simple variables, loops, conditionals and functions. PyMite is tiny, written in C, uses a static memory pool and can be embedded. It has an extremely limited set of builtin functions that is easy to configure. Similarly, the only standard libraries are partial implementations of string, dict, list and sys. The PyMite VM is part of the python-on-a-chip project, so it was designed to run on microcontrollers, but can run on posix-style desktop systems. The downside is that PyMite is not as extensively de-bugged as other Python implementations.