From: Charles O Nutter <headius@...>
Date: 2006-07-22T02:50:24+09:00
Subject: Re: [YAY] my sandboxing extension!!

------=_Part_124065_2332813.1153504220420
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Content-Disposition: inline

Jumping in from a JRuby perspective:

There are two points of interest here.

First, JRuby supports MVM currently, allowing you to run multiple virtual
Ruby processes within a single JVM. This would be much like sandboxing,
except the multiple runtimes are completely independent. We also have hooks
in Kernel#system to launch a new runtime in the same process if attempting
to execute a .rb file. This is all transparent to the user.

Second, RCR328 details a potential mechanism for launching a Ruby script
either out-of-process (spawned) or as an in-process MVM. The general idea is
that there should be a way to ask the runtime to launch script X such that
it runs completely independent of the current runtime (blocking, waiting
notwithstanding). This could easily extend to sandboxing...where
Kernel#ruby("xyz.rb") could launch the xyz script in the same process but
sandboxed.

With _why's sandboxing extension, JRuby's existing MVM support, and YARV's
future MVM support, it would seem we're all working toward similar goals.

On 7/20/06, Mauricio Fernandez <mfp@acm.org> wrote:
>
> On Wed, Jul 19, 2006 at 11:18:27PM +0900, why the lucky stiff wrote:
> > On Wed, Jul 19, 2006 at 08:00:15PM +0900, Mauricio Fernandez wrote:
> >
> > > So it doesn't support concurrent non-sandboxed Threads, right?
> >
> > Right, I don't have an answer for that yet.  I'd need to find a way to
> swap the
> > environment back in when the context changes.
>
> This looks like the sort of thing you'd want rb_thread_restore_context to
> do,
> but there's no hope without patching the interpreter :-|
>
> Would it be acceptable to add something resembling the event_hook
> subsystem,
> for context switches?
>
> --
> Mauricio Fernandez  -   http://eigenclass.org   -  singular Ruby
>
>


-- 
Charles Oliver Nutter @ headius.blogspot.com
JRuby Developer @ www.jruby.org
Application Architect @ www.ventera.com

------=_Part_124065_2332813.1153504220420--