unofficial mirror of emacs-devel@gnu.org 
 help / color / mirror / code / Atom feed
* Access control in Emacs?
@ 2021-09-14 12:49 Qiantan Hong
  2021-09-14 14:09 ` Phil Sainty
                   ` (3 more replies)
  0 siblings, 4 replies; 14+ messages in thread
From: Qiantan Hong @ 2021-09-14 12:49 UTC (permalink / raw)
  To: emacs-devel@gnu.org

As I’m experimenting making Emacs a collaborative “OS” (using crdt.el),
I inevitably encountered this classical OS question.
I’m adding more powerful features to crdt.el including buffer local variable
synchronizations and arbitrary remote command/function call,
however, it seems like they need to be accompanied by some access control
mechanism to be used “reasonably safely”.

Now I’m not sure about how to achieve that, there’re several ways I can see:
1. Really makes Emacs a multi-user OS. Add access control checks to 
all essential C primitives (which check against a current-user dynamic variable).
I don’t know how hard or intrusive it is. Does it worth it?

2. Another obvious thing I can do without touching massive amount of C code
is to add advice to interesting functions/primitives from Elisp side.

However I think this is bad security design comparing to 1 because it can
possibly open lots of loop holes, especially privilege promotion.
Suppose we don’t want Ben Bitdiddle to read our FS, we may add an
advice to insert-file-contents that check against an ACL (which excludes Ben).
However, if Ben has access to some other Lisp command that call some
C function that in turn calls insert-file-contents from C, the advice is never
invoked and this is easy privilege promotion.
We can only wish that we wrote a set of access control rules that have some
“closure” property, however given that lots of Emacs command are complex
and “intelligent”, I don’t think this is manageable.

I’m also not sure if extensive usage of advices is bad in a package supposedly
providing some fundamental feature.
I’m current using lots of advice already, to create “mock” buffer process object
that proxy I/O to a process on remote Emacs.

3. Or we can claim access control is for suckers. Trust your friends.

Thoughts?


Best,
Qiantan


^ permalink raw reply	[flat|nested] 14+ messages in thread

end of thread, other threads:[~2021-09-18  0:29 UTC | newest]

Thread overview: 14+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2021-09-14 12:49 Access control in Emacs? Qiantan Hong
2021-09-14 14:09 ` Phil Sainty
2021-09-14 14:28 ` dick
2021-09-14 15:05   ` Qiantan Hong
2021-09-14 15:52     ` dick
2021-09-14 16:02       ` Stefan Kangas
2021-09-14 14:49 ` Stefan Monnier
2021-09-15 20:11   ` Richard Stallman
2021-09-15 20:21   ` Robin Tarsiger
2021-09-14 18:13 ` Christine Lemmer-Webber
2021-09-14 19:59   ` tomas
2021-09-15 23:16   ` Qiantan Hong
2021-09-16  2:16     ` Christine Lemmer-Webber
2021-09-18  0:29       ` Richard Stallman

Code repositories for project(s) associated with this public inbox

	https://git.savannah.gnu.org/cgit/emacs.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).