Is luatex as secure as pdftex?

Question

My texmf.cnf file contains these lines:

% Allow TeX \openin, \openout, or \input on filenames starting with `.'
% (e.g., .rhosts) or outside the current tree (e.g., /etc/passwd)?
% a (any)        : any file can be opened.
% r (restricted) : disallow opening "dotfiles".
% p (paranoid)   : as `r' and disallow going to parent directories, and
%                  restrict absolute paths to be under $TEXMFOUTPUT.
openout_any = p
openin_any = a

But if I compile the following code via lualatex, the file /home/login/unsafe.txt is created!

\documentclass{article}
\usepackage{luatextra}
\begin{luacode*}
  function securityproblem(a)
    local file = assert(io.open(os.getenv("HOME") .. "/unsafe.txt", "w"))
    file:write("foobar\n")
    file:write(a)
    file:close()
  end
\end{luacode*}
\begin{document}
\directlua{securityproblem("\today")}
\end{document}

Is luatex as secure as pdftex?

Edit:

With the --safer option, luatex can't write files (via io.open) but fontspec (for example) is unusable.

Is there a safe way to use LuaTEX with fontspec (and other useful features of LuaTeX) ?

Answer 1

You have to be careful with the --safer option. lualatex --safer file.tex correctly disables many things. But lualatex file.tex --safer doesn't disable your example or os.remove() or give warnings about an incorrectly located option (at least with TeX Live 2012 under Windows).

According to the LuaTeX manual, --safer disables the following:

• os
  • execute, exec, setenv, rename, remove, tmpdir
• io
  • popen, output, tmpfile
• lfs
  • rmdir, mkdir, chdir, lock, touch

Furthermore, it disables loading of compiled LUA libraries (support for these was added in 0.46.0), and it makes io.open() fail on files that are opened for anything besides reading.

After a quick look through the documentation on these three libraries, I don't see much else obvious that could cause mischief. lfs.link() might be used to create a symlink and possibly cause issues under some circumstances.

You might also want the --no-socket option.

--nosocket makes the socket library unavailable, so that LUA cannot use networking.