Sandboxing Ruby Code - Lessons from the battlefield
summary
Covers techniques for running untrusted Ruby code safely, drawing on experience from Goldberg Pro and RubyMonk. Describes system-level (LXC, chroot, SELinux, kernel limits, ptrace), language-level (Ruby $SAFE levels), and application-level approaches, and mentions the open-source 'secure' Ruby gem that encapsulates some findings.
AI-written summary · about
chapters (23)
- 0:00Jasim A Basheer
- 0:19Tejas Dinkar
- 0:50Why Sandboxing?
- 1:44Goldberg Pro
- 3:25RubyMonk
- 4:33Common Attacks THIS IS EVAAAAAAAAAAALO!
- 4:56Use up resources
- 5:33Kill our services
- 6:20Read/Write to File
- 7:01Screw up Syntax Tree
- 7:46Steal our Code!
- 11:42Linux Containers
- 13:21Chroots
- 15:03Tainting
- 18:00$SAFE levels
- 19:03Sounds Great
- 25:26Split Process Arch
- 27:45Kernel Level Limits
- 29:02OS Dependent
- 32:50SELinux
- 34:15JVM tuning
- 38:29PTrace
- 40:06Clap Now!
related talks
36mSandboxing Ruby: The Good, the Bad, and the Fugly
36mUsing Ruby In Security Critical Applications
01h 25mSandboxing a Linux Application
38mSandboxing in Linux with zero lines of code
42mSandboxing a Linux application
38mSpelunking in Ruby
44mRuby Web Application Security Defense in Depth
47mSecure Sandboxing in a Post-Spectre World