2

I plan to launch online LuaTeX compile service.

I installed LuaTeX using TexLive 2015 in CentOS 7. For security concerns, I want to restrict opening files. Therefore, I set openin_any=p. But, it also restricts opening template files installed in texmf-dist. Other compilers can read template files.

I tried to compile this file:

\documentclass{ltjsarticle}
\usepackage{graphicx}



\title{title}


\author{auth}
\date{\today}
\begin{document}
\maketitle
\section{section}

This is sample.

\end{document}

I compiled this file by lualatex sample.tex and got a message as follow:

This is LuaTeX, Version beta-0.80.0 (TeX Live 2015) (rev 5238) 
 restricted \write18 enabled.
(./sample.tex
LaTeX2e <2016/02/01>
Babel <3.9o> and hyphenation patterns for 1 language(s) loaded.

lualatex: Not reading from /usr/local/texlive/2015/texmf-dist/tex/luatex/luatexja/ltjsarticle.cls (openin_any = p).

! LaTeX Error: File `ltjsarticle.cls' not found.

Type X to quit or <RETURN> to proceed,
or enter new name. (Default extension: cls)

How can I fix it?

garasubo
  • 21
  • I am really on the fence about whether this is really a LuaTeX question or a CentOS 7 concern. On the other hand I know that some questions don't fit squarely into one or the other. From the question, and I am sure this is my ignorance speaking, I don't know what code you are trying to tweak. Are you modifying system files, .tex files, script files? – A Feldman Feb 11 '16 at 14:48
  • I modified texmf.cnf and set openin_any = p. – garasubo Feb 13 '16 at 02:52
  • 1
    Being paranoiac has consequences ;-) Did you read Is luatex as secure as pdftex? – Paul Gaborit Feb 13 '16 at 07:26
  • 1
    That's a difference between LuaTeX and the other engines that should be fixed, in my opinion. The “paranoid” setting is meant for excluding all directories except those specifically allowed and, most certainly, TEXMFMAIN is to be allowed. Otherwise the engine is completely useless. – egreg Feb 13 '16 at 09:47
  • You could make a bug report at the luatex mailing list (http://tug.org/mailman/listinfo/luatex) or the bug tracker http://tracker.luatex.org/ – Ulrike Fischer Feb 13 '16 at 11:32
  • Of course, this file can be compiled when I set openin_any = r. I reported this problem to the bug tracker. http://tracker.luatex.org/view.php?id=963 – garasubo Feb 14 '16 at 10:03

1 Answers1

1

About TeX as online service: [http://cseweb.ucsd.edu/~hovav/dist/texhack.pdf

About Lua: formats can redefine lua as they want, so

local myopen = function(...) print("ERROR: open is not permitted") return false end
local _std = {}
_std.oldopen = io.open
io.open = myopen 
for k,v in pairs(_std) do print(k,v) end
assert(io.open("foo"), 'Error on io.open' )

io.open is safe (until _std is hidden)

If one doesn't care about io.open:

local myopen = function(...) print("ERROR: open is not permitted") return false end
io.open = myopen 
assert(io.open("foo"), 'Error on io.open' )
Luigi Scarso
  • 566
  • 2
  • 4
  • Ciao Luigi! I'm not sure this answers the question. If open_any=p is set in texmf.cnf, then LuaTeX does not read in TEXMFMAIN, TEXMFLOCAL and TEXMFHOME, which is something the other TeX engines do, instead. – egreg Feb 14 '16 at 21:02
  • Luatex has a callbacks system and some functions that can exclude kpse: it depends to the format to enable or not (and how) these callbacks (this is something that should be considered for an online service). In this case there are not callbacks, and kpse is called. The function kpathsea_name_ok seems to look only $TEXMFOUTPUT in the paranoid mode, so when I set $TEXMFOUTPUT the example works as expected. I don't see $TEXMFOUTPUT in my cnf files, so it looks as a distro issue, and not a luatex problem, but I have mailed to kb asking som details. – Luigi Scarso Feb 14 '16 at 23:55
  • Sorry, but I consider this to be a bug in LuaTeX, unless you tell how to reenable looking in the admissible trees when the option is open_any=p, like all other TeX engines. Reading only in TEXMFOUTPUT doesn't make much sense, if you can't access article.cls to begin with. – egreg Feb 15 '16 at 00:06