[ruby-talk:00966] Re: Bastion or SecurityManager for Ruby?

Hello Clemens,

clemens.hintze> Suppose I want to embed Ruby in my own application... So my
clemens.hintze> application becomes able to read and execute Ruby scripts!
clemens.hintze> 
clemens.hintze> My question now: Is there any possibility to restrict the access to
clemens.hintze> certain commands within my embedded interpreter? I think especially
clemens.hintze> for commands like: open, system, require, socket, loading
clemens.hintze> extensions... and the like.

  I guess your program will process source code read from network , or
input by users. In this case you don't want to trust whole external ruby
script, do you?  As discussed in another ruby Mailing List, whose name
is ruby-list, you can specify an option '-T3' to ruby interpreter to
meet your need.
 There are also -T1, -T2, and -T4 options. By using '-T3' security level,
you can disable almost all effective system calls called in the script.
I strongly recommend you to read the ML archive and an official Ruby
book which is just released last month. But both the mail archive and
the book are written in Japanese. I think it's a real problem, isnt it?

  If you strongly want to read the discussion about the security options
and articles in the book, I'll translate it for you. Maybe matz is
too busy to do it....
 And, I wish I had enough spare time to translate the whole book into
English!!!

Kengo Nakajima