[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: package security auditing and isolation

From: Stefan Monnier
Subject: Re: package security auditing and isolation
Date: Thu, 06 Apr 2017 16:12:22 -0400
User-agent: Gnus/5.13 (Gnus v5.13) Emacs/26.0.50 (gnu/linux)

> We have to operate openly, because it's the only practical choice other
> than forming a cabal or ignoring the problem.


> Heuristics are not what I had in mind.

You mentioned "finding the function calls that can be dangerous", which
to me sounds like the usual flawed approach of "anti-virus" looking for the
known exploits.

> a) Can the parse tree of a package be analyzed safely (without running
> code in the package)? Is it deterministic?

Yes, currently the reader is pretty much unaffected by Elisp code.

> b) If the parse tree of a package is analyzed, and only has whitelisted
> functions such as `string-equal' in it, does that make the package safe?

We have unsafep.el which tries to use such a white-list approach.
I doubt it's really bulletproof, but in any case I don't think you could
write a useful Elisp package with that subset.
[ IIRC it was introduced as part of ses.el to check safety of formulas
  in SES spreadsheets, so full-generality was not a goal.  ]

> c) Can the parse tree of a package be compared deterministically at two
> separate VCS checkpoints to find what's changed?

Yes, of course.

> d) Can the changes to the parse tree between two VCS checkpoints be
> signed by a reviewer?

Technically, yes, of course.


reply via email to

[Prev in Thread] Current Thread [Next in Thread]