[Vm-dev] [squeak-dev] File & Socket Handle Access

Denis Kudriashov dionisiydk at gmail.com
Wed Aug 16 12:13:56 UTC 2017


2017-08-16 13:52 GMT+02:00 Bert Freudenberg <bert at freudenbergs.de>:

>
> On Wed, Aug 16, 2017 at 1:36 PM, Denis Kudriashov <dionisiydk at gmail.com>
> wrote:
>
>> Hi Eliot.
>>
>> I asked David why he didn't add it to the SocketPlugin in the first place
>>> and he discussed Andreas Rabb's security concerns
>>
>>
>> It would be interesting to read about them because it looks strange that
>> it is secure to manage OS handle from VM but not secure to manage it from
>> image side. Both ways are requested by user directly or indirectly which
>> means that user has OS permissions. So what the difference?
>>
>
> ​It's for when yo​u want to allow arbitrary code to be executed in the
> image, yet still protect the machine from harm. This happens when sharing
> objects between images - an object could have malicious code attached. So
> in that case, before running the code, we turn on the VM file sandbox via
> the SecurityPlugin. This ensures that the image can only access files in a
> sandbox directory but not outside. But it only works if the FilePlugin is
> the only way to access files - meaning FFI and OSProcess etc. must be
> disabled, and there must not be another way to create file handles.
>

Thank's Bert. It is clear but I wonder how it can really work. Because if
you are able turn on/off VM file sandbox during image runtime then how
system prevents arbitrary code to turn off this security back to perform
bad actions?
And if it is static setting for whole image session then why it is really
useful? OS security solves all these issues.

I ask because I have no idea about SecurityPlugin. So maybe you will point
me to some doc.


>
> So IMHO, if the goal is to get a raw handle for using in FFI, then that's
> okay, since all security goes out the door as soon as FFI is enabled
> anyway. And if FFI is not enabled, then the raw file handle isn't useful,
> so there is no need to restrict read-access to it. Or am I missing
> something?
>
> TL;DR read-only access to raw file handle may not be a security issue.
>
> - Bert -
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.squeakfoundation.org/pipermail/vm-dev/attachments/20170816/3a0a41cc/attachment.html>


More information about the Vm-dev mailing list