bug#45198: 28.0.50; Sandbox mode

[Stefan Monnier <monnier@iro.umontreal.ca>]

>> The normal way to enable flymake is something like
>>
>>     (add-hook 'emacs-lisp-mode #'flymake-mode)
>>
>> so the file gets compiled just because you're looking at it.
>> That's quite different from an explicit request from the user to compile
>> a file.
>
> It is?  Sorry, I don't see the difference, not a significant one.

It make `C-x C-f` a tool to run arbitrary code (since the file may end
with something apparently harmless like `.txt` but may actually use
`emacs-lisp-mode`).

> If you are implying that one does something conscious and deliberate
> before byte-compiling a file,

Have you ever byte-compiled a random ELisp file sent to you from some
unknown email address without looking at it first?

Have you ever viewed with Emacs a file sent from some unknown
email address?

For me the answers are "no, never" and "yes, many times".
Enabling flymake mode as above currently blurs the difference between
those two cases in terms of risks.

> then one could also remove Flymake from the hook while at that.

The whole point of the sandboxing exercise is so as to be able to have
flymake-mode in the hook without exposing yourself to
these vulnerabilities.


        Stefan