chmod - change permissions on a file

Question

I have a Python virtualenv, and the Python executable is located in the /bin directory. In this virtualenv I'll have to execute some unsafe code, that can damage my system. I tried to chmod a-r on the virtualenv, and now nobody can write there, but its parent directory is now unprotected.
So I thought I could change permissions on /bin/python, so that it can write nowhere, how can I do this?
I tried chmod a-r bin/python but it is still allowed to remove files and directories even outside the env.

Answer 1

Firstly, chmod a-r bin/python does not prevent python to remove files. It prevents anyone not owner or not in the correct group to read that file.

If you wish to run unsafe code in a "jail", I suggest using chroot jail. Bear in mind that in order for chroot to run effectively, python executable should not be ran under root privileges.

Answer 2

Python will run with the permissions of the user that invokes it, so you will never be able to limit what it can touch, manipulate and read.

Answer 3

Actually, chmod a-r bin/python prevents the file's owner, those in the file's group, and all other users from reading the file (except the superuser of course). chmod o-r bin/python would prevent all users except the owner and those in the file's group from reading the file. The file permissions of an executable do not affect its ability to read or edit other files. File permissions only determine which users can read, write, and execute the files to which they are applied (and a few other things).