Using the socket module in sandboxed Pypy

Question

I'm attempting to allow a subprocess sandboxed with Pypy to communicate, using a limited protocol, with the parent process.

After reviewing the source code of the pypy/pypy/translator/sandbox/sandlib.py included with Pypy, it appears that there is a VirtualizedSocketProc that allows os.open calls to open sockets. I've changed some functionality of the code (for example, allowing TCP connections on limited ports), but very little has been changed. However, I'm unable to actually import Pypy's socket module because it requires a non-existent _socket module, which seems to be located in the interpreter-level parts of the code.

Is what I'm trying to do feasible? If so, how do I import the socket module? If not, what else can I do?

Answer 1

I've investigated this further, and it appears that this is a fairly fundamental problem. The socket module, implemented at the library level (inside of the lib directories) is essentially an empty shell for the the _socket library, which is an interpreter-level module defined in the pypy/module directory. For those unfamiliar with PyPy, there are two types of modules that can be imported, roughly corresponding to the pure-Python and C libraries in CPython. Modules implemented at the library level can be included easily in the sandbox, and are in fact included in the "default" pypy_interact sandbox. However, modules written at the interpreter level are not available inside the sandbox.

It seems that my approach was fundmanetaly flawed, because of this critical distinction. Instead, there are a few other options that you can consider, should you run into the same problem:

1. Use os.open directly with a filename beginning with tcp://. This actually works very well and is my favoured approach.
2. Implement your own socket library. This is certainly not preferable, but I believe that it would be possible to create a relatively empty socket library that simply communicates with the sandbox controller as above wrapping the socket functionality. It might even be possible to modify the default socket library to achieve this (without including _socket, for example).