LuaL_openlibs() and sandboxing scripts

Question

I am embedding Lua (5.1) in a C/C++ application.

I am using the LuaL_openlibs() function to load the base libs. However, this function loads some other libraries which I want to disable so that they are not available to my Lua scripts.

Specifically, I want to disable the IO and OS modules. Is there a function I can call to programmativally disable (or unload) these modules so that I can create a safe sandbox environment for running Lua scripts?

Answer 1

luaL_openlibs just iterates through a list of library loaders, declared in the same file. Simply delete/comment out the luaopen_io and luaopen_os lines. Done.

If you're adverse to editing the Lua source, then you can define your own function which leaves out those two libraries:

#define LUA_LIB

#include "lua.h"
#include "lualib.h"
#include "lauxlib.h"

static const luaL_Reg lualibs[] = {
  {"", luaopen_base},
  {LUA_LOADLIBNAME, luaopen_package},
  {LUA_TABLIBNAME, luaopen_table},
  {LUA_STRLIBNAME, luaopen_string},
  {LUA_MATHLIBNAME, luaopen_math},
  {LUA_DBLIBNAME, luaopen_debug},
  {NULL, NULL}
};

LUALIB_API void my_openlibs (lua_State *L) {
  const luaL_Reg *lib = lualibs;
  for (; lib->func; lib++) {
    lua_pushcfunction(L, lib->func);
    lua_pushstring(L, lib->name);
    lua_call(L, 1, 0);
  }
}

Answer 2

I don't know how to disable modules, but you can still choose which ones to load instead of loading them all with luaL_openlibs . Section 7.3 of the Lua 5.1 manual says:

The luaopen_* functions (to open libraries) cannot be called directly, like a regular C function. They must be called through Lua, like a Lua function.

That is, instead of directly calling the function as in Lua 5.0:

luaopen_table(L);

... you push it as a C function with its name and use lua_call or similar in Lua 5.1:

lua_pushcfunction(L, luaopen_table);
lua_pushliteral(L, LUA_TABLIBNAME);
lua_call(L, 1, 0);

The functions you can do this with are listed in lualib.h :

Function        | Name
----------------+-----------------
luaopen_base    | ""
luaopen_table   | LUA_TABLIBNAME
luaopen_io      | LUA_IOLIBNAME
luaopen_os      | LUA_OSLIBNAME
luaopen_string  | LUA_STRLIBNAME
luaopen_math    | LUA_MATHLIBNAME
luaopen_debug   | LUA_DBLIBNAME
luaopen_package | LUA_LOADLIBNAME

Answer 3

最简单的解决方案：加载库后，只需要io=nil;os=nil 。

Answer 4

In older versions of Lua you used to be able to specify which libraries you wanted to load. Specifically, in my copy of lualib.h I see the following functions declared:

LUALIB_API int (luaopen_base) (lua_State *L);
LUALIB_API int (luaopen_table) (lua_State *L);
LUALIB_API int (luaopen_io) (lua_State *L);
LUALIB_API int (luaopen_os) (lua_State *L);
LUALIB_API int (luaopen_string) (lua_State *L);
LUALIB_API int (luaopen_math) (lua_State *L);
LUALIB_API int (luaopen_debug) (lua_State *L);
LUALIB_API int (luaopen_package) (lua_State *L);
LUALIB_API void (luaL_openlibs) (lua_State *L); 

I couldn't tell you the consequences of not loading all the libraries, since I call luaL_openlibs() in my code. The First Edition of Programming in Lua is available online, and mentions that luaL_openlibs() should replace the luaopen_*() function calls. However, the older functions may still be included for backwards compatibility. http://www.lua.org/pil/24.1.html

HTH

Answer 5

Repeating my answer to another question here too.

As of Lua 5.3 you need to luaL_requiref these, based on the source code in luaL_openlibs . I found no reference to that in any manual. So here is an example that opens up only the base library which allows lua to print to standard output.

#include <lua.h>
#include <lualib.h>
#include <lauxlib.h>

int main( int argc, char *argv[] ) {

  lua_State *lua = luaL_newstate();
  luaL_requiref( lua, "_G", luaopen_base, 1 );
  lua_pop( lua, 1 );

  luaL_dostring( lua, "print \"Hello, lua\"" );

  lua_close( lua );

  return 0;
}

For example you can load only in addition to base the I/O library like so.

luaL_requiref( lua, LUA_IOLIBNAME, luaopen_io, 1 );
lua_pop( lua, 1 );

See also the manual .