Is it possible to design a compiler that can safely compile and run untrusted code?As a practical example, I want to know how the online compilers are designed/programmed?(Like the one on codepad.org) Are they similar to our traditional day-to-day compiler. How they are hosted on servers?
How are the web based compilers designed?
compilers
This question is asked on stackoverflow:How do sites like codepad.org and ideone.com sandbox your programA short summary from the answers:Using geordi (codepad does this)SystraceVirtualization (VM)OS level jailing functionalitychrootPermissionsulimitnice, ionice, cpulimit,disk quotasAppArmor, SELinuxRestrict compiler access to headers/librariesRestrict interpreter access to librariesStatic analysislibsandboxA more theoretical answer would be that it is possible to restrict all calls out of the program, (syscalls, function calls etc.), in a manner similar to how native client works, if you have control of the compiler (and even moreso, if you control the CPU and OS). For time and memory consumption, you can simply have have cut-offs that would kill the compilation process/running program. This should only leave you vulnerable to bugs in the compiler, runtime libs, and the OS/hardware level; which a VM can mostly eliminate the danger of.