_______________________________________________ Cmdist mailing list [email protected] https://cm-mail.stanford.edu/mailman/listinfo/cmdist
Interesting question. My first thought is that you could undefine
procedure-source,
object->let, funclet, object->string with :readable, rootlet, outlet (in
the untrusted
environment, like sandbox in stuff.scm), but the list seems to keep
getting longer, and
blocking format with ~W seems to require wrapping format. You could
wrap the trusted
function in a c-object, then call it with (obj . args) which applies the
arguments to
the wrapped function. The c-object could hide everything from normal
intrusions from
scheme. Or I think I could add an opaque (or "private"?) flag so that
these kinds of
introspection would be blocked on functions. This would affect funclet,
object->let,
object->string, format, etc. But all of these are vulnerable to
"probes" (like
probe-eval in stuff.scm but maybe more sinister), so the wrapper would
have to scan
the args and refuse to call the function if it finds an openlet. Now
I'm worrying that
a closed let could wait until it is ingested by a function, then open
itself, grab
whatever it wants, then close itself so no one is the wiser. We'd have
to block
curlet, outlet, owlet, and rootlet I think. But lets are referenced all
the time,
and I don't want to slow down normal scheme code checking opaque bits on
them. And
I feel like I'm missing something. How secure does the trusted call need
to be?
- [CM] sandboxing Elijah Stone
- Re: [CM] sandboxing bil
