Creating sandboxes with the admin api

Question

I'm trying to write some code that creates sandboxes through
the admin api. For these sandboxes, I want to only enable a
specific set of functions. Unfortunately, when you create a sandbox
with getSecuritySandboxes, it enables all functions by default. I
therefore need to disable all the securable functions before
enabling the ones I trust. I've run into two problems in doing
this, and wondered if anyone had any advice.
1) The api provides a function called
getSecurableCFFunctions, which is meant to return all the functions
that can be secured. Unfortunately, the function list returned by
this function is not complete - it is missing createobject(com),
createobject(corba), createobject(java), createobject(webservice),
getgatewayhelper and sendgatewaymessage. There's no way of finding
out the enabled functions for a sandbox, so I've currently had to
resort to disabling all the functions returned by
getSecurableCFFunctions and then adding in the ones that I know are
missing. This approach is likely to be broken when future releases
of CF add new securable functions.
2) I use setDisabledCFFunction to disable functions, but can
find no way of disabling createobject(com), createobject(corba),
createobject(java) or createobject(webservice) with this function.
When I try, it throws an exception with this message: "This
function can not be added to the restricted function list.". These
functions are in the function list in the administrator, and I can
add them there. Is there any way of securing them through the api?
Any advice appreciated!
Thanks,
Max

Answer 1

Set up a "template" sandbox that has the permissions you
want, say E:\template. Then I think this will work:
obSandbox =
createObject("component","cfide.adminapi.security");
arDefaultSandbox = obSandbox.getSecuritySandboxes (
"E:\template" );
obSandbox.setSecuritySandbox ( directory = SandboxDirectory,
sandbox = arDefaultSandbox["E:\template"] );