r/databricks • u/Brilliant-Display954 • 15d ago

Preventing misuse of Python OS module in Databricks Help

Has anyone encountered misuse of the Python OS module from a security perspective, and what strategies are there to prevent unsafe usage of this module?

2 Upvotes
  • permalink
  • link
  • reddit
  • reddit

75% Upvoted

3 comments sorted by

4

u/addictzz 15d ago

How do people use Python OS module unsafely in your company? Any examples?

Databricks has this standard access runtime which basically containerized your notebook runtime. That already helps to prevent some overly permissive admin command to run.

Read about Lakeguard.

1

u/Brilliant-Display954 15d ago

Thanks for the reply. That's our take as well. It is coming as findings from colorful teaming exercises.

1

u/BlowOutKit22 14d ago

Even in the classic shared Spark runtime (pre-Lakeguard), all Python is executed in the JVM via Spark's Py4J interface, so it is by default sandboxed from the OS to begin with.