restricting the folders available in \input (etc) in LaTeX

I am running LaTeX on a server, users are collaborating and contributing files and the server runs LaTeX on a root file I produce which `\input`s user files (each user has her own special folder). The user then views the output. Documents typically have more than one author in this way. I want to allow users to be able to `\input` other files from their own bit of filespace, but no more than that.

I need to tighten the security. In particular I do not want users to go doing things like `\input{../../../systemfile}` or `\input{/etc/systemfile}` to grub around in my system and read files they should not have access to. I could re-write `\input` but can't see how I can prevent users accessing the original `\input` primitive (assuming of course they somehow found out what I called it). Any suggestions?

I am working in linux, and running pdflatex. (I'd like to use lualatex really but that introduces even more security problems.)

Richard

• thanks for the edits stefan! – Richard Jul 30 at 9:47

You can set these defaults in your installation `texmf.cnf` the default settings are

``````% Do we allow TeX \input or \openin (openin_any), or \openout
% (openout_any) on filenames starting with `.' (e.g., .rhosts) or
% outside the current tree (e.g., /etc/passwd)?
% a (any)        : any file can be opened.
% r (restricted) : disallow opening dot files
% p (paranoid)   : as `r' and disallow going to parent directories, and
%                  restrict absolute paths to be under \$TEXMFOUTPUT.
openin_any = a
openout_any = p
``````

you probably want to make `openin_any` be `p` rather than `a`.

• Thanks! That sounds just what I need! Let me be clear that this is based on the text following \input not the actual location or where the root is. So if I latex a file root.tex in directory HOME which \input s SUB/user.tex in subdirectory HOME/SUB then user.tex cannot even \input something back in the HOME directory or some other subdirectory of it? That's what I want! – Richard Jul 30 at 10:24
• yes, also of course you can normally restrict via standard unix file perms but I guess here all jobs are running under your servers id so you can not use file permissions to restrict between users? – David Carlisle Jul 30 at 10:29
• relative paths in tex (web2c implementations) are always interpreted relative to the working directory of the process, so as long as you cd to the main document for each user before starting tex then users can not access ../ out of their directory with r or p setting – David Carlisle Jul 30 at 10:31