From: aurelianito <aurelianocalvo@...>
Date: 2005-10-11T04:36:52+09:00
Subject: Re: Save the world from evil code crusade

> > > > I want to say things like evil.rb code can write to "evil.log" but to
> > > > nothing else.
> > > > How can use threads to say this kind of things with threads?
> > >
> > > Since you don't want to use $SAFE, the answer really is:
> > >
> > > There is no pretty prepackaged way to do what you want to do.  You can
> > > certainly try writing it yourself, and good luck with that if you do, but a
> > > solution using $SAFE is the only thing that will get you close to what you
> > > want in the short term.
> > >
> > >
> >
> > That's why I've started the securedruby project
> > (http://securedruby.rubyforge.org). My problem is that I'm unable to
> > stop "evil code" to modify already defined classes. The idea of the
> > library (already only vaporware) is to redefine all the potentially
> > dangerous operations in the core library to check for permissions.
>
> Setting up a list of "unsafe" methods (blacklisting) is likely to
> break when more methods are added. Instead, I'd set up a list of
> *safe* methods (whitelisting).

I agree. But my idea is to leave security configuration to the
administrator. I want to give him/her the tools necesary to disable
unwanted behaviour.

> For the unsafe code part, I'd use safemode and proxy over the classes
> you want to allow by overriding the MyClass constant with a pure
> method_missing based proxy.  The proxyied calls can be filtered for
> security on the "outside", where only your code runs.

I'm interested with this option. How do you avoid the unsafe code to
bypass the proxy? can you show me some ruby (pseudo)code?

Thank's,
Aureliano.