Question on multiple Python users in one application

[Chris Angelico]

On Fri, Oct 7, 2016 at 7:59 AM, Jolly Good Spam
<myspamacct at earthlink.net> wrote:
> I have a Windows multi-user program that can be used by an arbitrary number
> of users at once. They can work independently, or they can share data at the
> file or even variable level if they want. I want to give them the ability to
> write Python programs within this environment. So I intend to embed CPython
> access in the program.

Okay. Before you go one micron further, answer this critical question:

*Do you trust your users?*

Would you permit your users to have complete access to the computer
that this program is running on? If they're all people in the same
company, running something on the company's own server, you're fine.
But if there's even the slightest chance that a malicious user will be
on this system, you MUST NOT permit arbitrary code. CPython is *not* a
secured environment.

So, on to the specifics.

> The basic embedding of CPython seems straight forward. But since I have
> multiple users, each needs their own Python sandbox, so if they all compile
> programs with variable 'spam', it doesn't collide. Of course they can all have
> different programs running at the same time too.

You want them to be able to share data, even at the level of a single
variable. That strongly suggests using the same CPython embed for all
your users. You can avoid name collisions simply by giving each user a
module; one person's "spam" doesn't collide with another user's "spam"
any more than math.log collides with logging.log. However, this is
*not* protecting one user from another - it just protects against
accidents. (I could easily reach into someone else's module by typing
"fred.spam = 123".)

So the question really becomes: How independent should the Pythons be?
Sharing data is far easier if they're less isolated, but then it's
harder to multithread.

And above all, the security question.

ChrisA