TeX - LaTeX Stack Exchange is a question and answer site for users of TeX, LaTeX, ConTeXt, and related typesetting systems. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

My texmf.cnf file contains these lines:

% Allow TeX \openin, \openout, or \input on filenames starting with `.'
% (e.g., .rhosts) or outside the current tree (e.g., /etc/passwd)?
% a (any)        : any file can be opened.
% r (restricted) : disallow opening "dotfiles".
% p (paranoid)   : as `r' and disallow going to parent directories, and
%                  restrict absolute paths to be under $TEXMFOUTPUT.
openout_any = p
openin_any = a

But if I compile the following code via lualatex, the file /home/login/unsafe.txt is created!

  function securityproblem(a)
    local file = assert(io.open(os.getenv("HOME") .. "/unsafe.txt", "w"))

Is luatex as secure as pdftex?


With the --safer option, luatex can't write files (via io.open) but fontspec (for example) is unusable.

Is there a safe way to use LuaTEX with fontspec (and other useful features of LuaTeX) ?

share|improve this question
Have you tried with lualatex --safer --no-shell-escape? The manual hints that otherwise functions such as io.open can be used as in normal lua. – Alexander Mar 4 '13 at 23:07

You have to be careful with the --safer option. lualatex --safer file.tex correctly disables many things. But lualatex file.tex --safer doesn't disable your example or os.remove() or give warnings about an incorrectly located option (at least with TeX Live 2012 under Windows).

According to the LuaTeX manual, --safer disables the following:

  • os
    • execute, exec, setenv, rename, remove, tmpdir
  • io
    • popen, output, tmpfile
  • lfs
    • rmdir, mkdir, chdir, lock, touch

Furthermore, it disables loading of compiled LUA libraries (support for these was added in 0.46.0), and it makes io.open() fail on files that are opened for anything besides reading.

After a quick look through the documentation on these three libraries, I don't see much else obvious that could cause mischief. lfs.link() might be used to create a symlink and possibly cause issues under some circumstances.

You might also want the --no-socket option.

--nosocket makes the socket library unavailable, so that LUA cannot use networking.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.