I am embedding Lua (5.1) in a C/C++ application.
I am using the LuaL_openlibs() function to load the base libs. However, this function loads some other libraries which I want to disable so that they are not available to my Lua scripts.
Specifically, I want to disable the IO and OS modules. Is there a function I can call to programmativally disable (or unload) these modules so that I can create a safe sandbox environment for running Lua scripts?
luaL_openlibs just iterates through a list of library loaders, declared in the same file. Simply delete/comment out the luaopen_io and luaopen_os lines. Done.
If you're adverse to editing the Lua source, then you can define your own function which leaves out those two libraries:
#define LUA_LIB
#include "lua.h"
#include "lualib.h"
#include "lauxlib.h"
static const luaL_Reg lualibs[] = {
{"", luaopen_base},
{LUA_LOADLIBNAME, luaopen_package},
{LUA_TABLIBNAME, luaopen_table},
{LUA_STRLIBNAME, luaopen_string},
{LUA_MATHLIBNAME, luaopen_math},
{LUA_DBLIBNAME, luaopen_debug},
{NULL, NULL}
};
LUALIB_API void my_openlibs (lua_State *L) {
const luaL_Reg *lib = lualibs;
for (; lib->func; lib++) {
lua_pushcfunction(L, lib->func);
lua_pushstring(L, lib->name);
lua_call(L, 1, 0);
}
}
I don't know how to disable modules, but you can still choose which ones to load instead of loading them all with luaL_openlibs. Section 7.3 of the Lua 5.1 manual says:
The
luaopen_*functions (to open libraries) cannot be called directly, like a regular C function. They must be called through Lua, like a Lua function.
That is, instead of directly calling the function as in Lua 5.0:
luaopen_table(L);
... you push it as a C function with its name and use lua_call or similar in Lua 5.1:
lua_pushcfunction(L, luaopen_table);
lua_pushliteral(L, LUA_TABLIBNAME);
lua_call(L, 1, 0);
The functions you can do this with are listed in lualib.h:
Function | Name
----------------+-----------------
luaopen_base | ""
luaopen_table | LUA_TABLIBNAME
luaopen_io | LUA_IOLIBNAME
luaopen_os | LUA_OSLIBNAME
luaopen_string | LUA_STRLIBNAME
luaopen_math | LUA_MATHLIBNAME
luaopen_debug | LUA_DBLIBNAME
luaopen_package | LUA_LOADLIBNAME
In older versions of Lua you used to be able to specify which libraries you wanted to load. Specifically, in my copy of lualib.h I see the following functions declared:
LUALIB_API int (luaopen_base) (lua_State *L);
LUALIB_API int (luaopen_table) (lua_State *L);
LUALIB_API int (luaopen_io) (lua_State *L);
LUALIB_API int (luaopen_os) (lua_State *L);
LUALIB_API int (luaopen_string) (lua_State *L);
LUALIB_API int (luaopen_math) (lua_State *L);
LUALIB_API int (luaopen_debug) (lua_State *L);
LUALIB_API int (luaopen_package) (lua_State *L);
LUALIB_API void (luaL_openlibs) (lua_State *L);
I couldn't tell you the consequences of not loading all the libraries, since I call luaL_openlibs() in my code. The First Edition of Programming in Lua is available online, and mentions that luaL_openlibs() should replace the luaopen_*() function calls. However, the older functions may still be included for backwards compatibility. http://www.lua.org/pil/24.1.html
HTH
Repeating my answer to another question here too.
As of Lua 5.3 you need to luaL_requiref these, based on the source code in luaL_openlibs. I found no reference to that in any manual. So here is an example that opens up only the base library which allows lua to print to standard output.
#include <lua.h>
#include <lualib.h>
#include <lauxlib.h>
int main( int argc, char *argv[] ) {
lua_State *lua = luaL_newstate();
luaL_requiref( lua, "_G", luaopen_base, 1 );
lua_pop( lua, 1 );
luaL_dostring( lua, "print \"Hello, lua\"" );
lua_close( lua );
return 0;
}
For example you can load only in addition to base the I/O library like so.
luaL_requiref( lua, LUA_IOLIBNAME, luaopen_io, 1 );
lua_pop( lua, 1 );
See also the manual.
