From: Martin Honermeyer <maze@...>
Date: 2005-10-09T21:13:31+09:00
Subject: Re: Save the world from evil code crusade

Maybe there is something to learn from .NET.

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/cpguide/html/cpconintroductiontocodeaccesssecurity.asp


Regards,
Martin


aurelianito wrote:

>> > I want to say things like evil.rb code can write to "evil.log" but to
>> > nothing else.
>> > How can use threads to say this kind of things with threads?
>>
>> Since you don't want to use $SAFE, the answer really is:
>>
>> There is no pretty prepackaged way to do what you want to do.  You can
>> certainly try writing it yourself, and good luck with that if you do, but
>> a solution using $SAFE is the only thing that will get you close to what
>> you want in the short term.
>>
>>
>> Kirk Haines
> 
> That's why I've started the securedruby project
> (http://securedruby.rubyforge.org). My problem is that I'm unable to
> stop "evil code" to modify already defined classes. The idea of the
> library (already only vaporware) is to redefine all the potentially
> dangerous operations in the core library to check for permissions. But
> I'm unable to add this check to method redefinition. That's why I've
> started two threads on this group (this one and "method added hook").
> 
> Do you know how can I achieve it (prevent class modification in some
> situations)?
> 
> Aureliano.