Is there a "safe" subset of Python for use as an embedded scripting language?

Here are a couple of links to give you an idea on what you're up against:

• How can I run an untrusted Python script safely (i.e. Sandbox)
• Capabilities for Python? by Guido himself

There is also a dead google code project at http://code.google.com/p/sandbox-python/

The pypy project offers sandboxing features, see http://doc.pypy.org/en/latest/sandbox.html .

No there is no production ready subset of Python that is "safe". Python has had a few sand box modules which were deprecated due to deficiencies.

Your best bet is to either create your own parser, or isolate the python process with syscall hooks and a jailed account.

Some people might point you to PyPy, but it is unfinished.

AFAIK, some attempts were made in standard python library, but they were not successful. See Restricted Execution for details.

Warning

In Python 2.3 these modules have been disabled due to various known and not readily fixable security holes. The modules are still documented here to help in reading old code that uses the rexec and Bastion modules.