From: Eivind Eklund <eeklund@...>
Date: 2005-10-10T22:44:47+09:00
Subject: Re: Save the world from evil code crusade

On 10/8/05, aurelianito <aurelianocalvo@yahoo.com.ar> wrote:
> > > I want to say things like evil.rb code can write to "evil.log" but to
> > > nothing else.
> > > How can use threads to say this kind of things with threads?
> >
> > Since you don't want to use $SAFE, the answer really is:
> >
> > There is no pretty prepackaged way to do what you want to do.  You can
> > certainly try writing it yourself, and good luck with that if you do, but a
> > solution using $SAFE is the only thing that will get you close to what you
> > want in the short term.
> >
> >
>
> That's why I've started the securedruby project
> (http://securedruby.rubyforge.org). My problem is that I'm unable to
> stop "evil code" to modify already defined classes. The idea of the
> library (already only vaporware) is to redefine all the potentially
> dangerous operations in the core library to check for permissions.

Setting up a list of "unsafe" methods (blacklisting) is likely to
break when more methods are added. Instead, I'd set up a list of
*safe* methods (whitelisting).

For the unsafe code part, I'd use safemode and proxy over the classes
you want to allow by overriding the MyClass constant with a pure
method_missing based proxy.  The proxyied calls can be filtered for
security on the "outside", where only your code runs.

Eivind.