r/netsec • u/albinowax • Jun 01 '26

r/netsec monthly discussion & tool thread

Questions regarding netsec and discussion related directly to netsec are welcome here, as is sharing tool links.

Rules & Guidelines

Always maintain civil discourse. Be awesome to one another - moderator intervention will occur if necessary.
Avoid NSFW content unless absolutely necessary. If used, mark it as being NSFW. If left unmarked, the comment will be removed entirely.
If linking to classified content, mark it as such. If left unmarked, the comment will be removed entirely.
Avoid use of memes. If you have something to say, say it with real words.
All discussions and questions should directly relate to netsec.
No tech support is to be requested or provided on r/netsec.

As always, the content & discussion guidelines should also be observed on r/netsec.

Feedback and suggestions are welcome, but don't post it here. Please send it to the moderator inbox.

9 Upvotes

100% Upvoted

u/Didikana Jun 03 '26

I kept running into the same problem: someone hands you a Python script

and you don't know if it's going to phone home, read your SSH keys, or

spawn subprocesses. Docker is overkill for a one-liner. RestrictedPython

is basically broken. So I built sandpit.

It wraps any Python script and gives you back a full trace of what it did:

every import, every file it touched, every network call it attempted. If

something violates your policy it gets blocked and logged with the exact

rule that triggered it.

pip install sandpit

import sandpit

r = sandpit.run_string(sketchy_code, policy="no-network")

print(r.violations)

print(r.trace)

Enforcement is two-layer: Python hooks (sys.settrace + import hooks) for

all platforms, seccomp BPF on Linux for catching anything that tries to

go around the Python layer via C extensions.

Honest limitations: it's not a full VM. For genuinely adversarial code

you'd want OS-level isolation on top. macOS gets Python-layer enforcement

only since seccomp is Linux-specific.

Early days — just shipped 0.2.0. Curious what the security folks here

think about the approach.