Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

The trusted base for Crochet is too big! #24

Open
robotlolita opened this issue Oct 3, 2021 · 0 comments
Open

The trusted base for Crochet is too big! #24

robotlolita opened this issue Oct 3, 2021 · 0 comments
Labels
error Something is confusing, misbehaving, or harmful. s:1 moderate This is bad. We should deal with this as soon as possible.
Milestone
First stable release

Comments

@robotlolita
Copy link
Contributor

Currently all of the packages in the standard distribution are part of the trusted base. Packages in the trusted base get more powerful FFI access, construction and projection capabilities over intrinsic types, and are able to load native code without requiring a native capability.

This makes the surface of dangerous attacks in Crochet too large. Bugs in an otherwise innocuous package, such as crochet.text.regex, could allow malicious code to get access to all of this power, effectively subverting most of the runtime safety mechanisms in Crochet.

This won't be addressed for the first experimental release, as it requires significant amount of work around safe native code support, but it's important that people are aware of this issue.
@robotlolita robotlolita added error Something is confusing, misbehaving, or harmful. s:1 moderate This is bad. We should deal with this as soon as possible. labels Oct 3, 2021
@robotlolita robotlolita mentioned this issue Oct 3, 2021
Merged
robotlolita added a commit that referenced this issue Oct 3, 2021
@robotlolita
Check projection and construction capabilities (#23)
00c971f 
This adds the checks for construction and projection capabilities back to Crochet. The rule is that these capabilities are only available for the defining package---but here we run into a problem: intrinsic types have no packages! Still, trusted packages need to manipulate these intrinsic types and provide a view to them.

The temporary solution this PR adds is to skip intrinsic capability checks for trusted packages---but the trusted base for Crochet is too big currently (#24), mostly as a result of native code being unsafe to load right now. This shouldn't be too much of a problem yet because intrinsic types have no real power.

This fixes #14.
@robotlolita robotlolita added this to the First stable release milestone Dec 11, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
error Something is confusing, misbehaving, or harmful. s:1 moderate This is bad. We should deal with this as soon as possible.
Projects
None yet
Milestone
First stable release
Development

No branches or pull requests
1 participant
@robotlolita