From: Charles Oliver Nutter <headius@...>
Date: 2010-05-26T04:39:02+09:00
Subject: Re: Eval, SAFE, and Sandbox

On Sun, May 23, 2010 at 7:43 AM, Caleb Clausen <vikkous@gmail.com> wrote:
> $SAFE is unlikely to be good enough. Even why's sandbox probably has
> some vulnerabilities.

To be honest, I'm not sure I trust $SAFE because it takes such a
scattered approach to performance. Basically every operation that
mutates needs to check for tainting (and now "untrust" in 1.9) or
there's a hole. That's a lot of code to ensure is always doing the
right thing.

Plus C extensions either need to be disabled or audited as well.

Granted...$SAFE is what's available on MRI, so I don't have another
solution for non-JRuby users.

> Another idea; if you want to use jruby, you could take advantage of
> the jvm's sandboxing capabilities. I believe this would require some
> custom java security manager programming.

Actually it can often just come down to configuration. "Programming" a
security manager isn't generally needed to secure a server or sandbox
an application.

- Charlie