Actually, the main problem I'm having now is that RestrictedPython doesn't allow "yield". It's not something you implement a policy for like with many other things about RestrictedPython, it's just disabled. That must mean the developers consider the operation unsafe.
I must use "yield" for the scripting, and if I need to punch a security hole into the scripting part of the game, there's no point having any security. In that case, I'll just have a completely untrusted level format that are as dangerous as executables. I'll have to warn users to only run levels they trust. This will hurt level editing
However, I need to look into this. There's a chance "yield" is disabled only to prevent the possibility freeze a script or the game, rather to prevent damaging the computer it runs on. If this is the case, I can allow "yield" while still considering the level format safe. I really hope this is the case, because then level editing and scripting won't be a problem.
LP: If I run RestrictedPython I never planned to let players play untrusted levels. The thing is, room scripts are loaded and unloaded on the fly in the game, and it's inconvenient and possibly slow to iterate through them all when you start a level. What happens with RestrictedPython is that when the player enters a room and illegal code is found, it just stops the game and displays a warning.
However, your suggestion is still not bad. There's a lot that can be done with untrusted code; connecting to a server, changing dialogue depending on real life news or whatever. What I might do is instead to let the level designer decide if they want to have their code running with RestrictedPython or not. They just set a flag in the World.ini file like RestrictedPython=0 - if they do set it to 0, a warning is displayed for users who open their levels that the level is potentially unsafe and they can decide if they want to play it or not. If it's set to 1, the code runs with RestrictedPython and stops if the script tries to do things it's not allowed to.
However, I won't iterate through all the rooms figuring out there's any illegal code. It's way too much work that and it isn't any safer than just running RestrictedPython when the player reaches a room (the only gain is one less parameter in World.ini). The easiest and fastest solution is often the best.
But well, before all that, I need to figure out why Yields are disabled