LuaTex doesn't open installed packages with openin_any=p options

Question

I plan to launch online LuaTeX compile service.

I installed LuaTeX using TexLive 2015 in CentOS 7. For security concerns, I want to restrict opening files. Therefore, I set openin_any=p. But, it also restricts opening template files installed in texmf-dist. Other compilers can read template files.

I tried to compile this file:

\documentclass{ltjsarticle}
\usepackage{graphicx}



\title{title}


\author{auth}
\date{\today}
\begin{document}
\maketitle
\section{section}

This is sample.

\end{document}

I compiled this file by lualatex sample.tex and got a message as follow:

This is LuaTeX, Version beta-0.80.0 (TeX Live 2015) (rev 5238) 
 restricted \write18 enabled.
(./sample.tex
LaTeX2e <2016/02/01>
Babel <3.9o> and hyphenation patterns for 1 language(s) loaded.

lualatex: Not reading from /usr/local/texlive/2015/texmf-dist/tex/luatex/luatexja/ltjsarticle.cls (openin_any = p).

! LaTeX Error: File `ltjsarticle.cls' not found.

Type X to quit or <RETURN> to proceed,
or enter new name. (Default extension: cls)

How can I fix it?

Answer 1

About TeX as online service: [http://cseweb.ucsd.edu/~hovav/dist/texhack.pdf

About Lua: formats can redefine lua as they want, so

local myopen = function(...) print("ERROR: open is not permitted") return false end
local _std = {}
_std.oldopen = io.open
io.open = myopen 
for k,v in pairs(_std) do print(k,v) end
assert(io.open("foo"), 'Error on io.open' )

io.open is safe (until _std is hidden)

If one doesn't care about io.open:

local myopen = function(...) print("ERROR: open is not permitted") return false end
io.open = myopen 
assert(io.open("foo"), 'Error on io.open' )