Re: Access control in Emacs?

[Robin Tarsiger <rtt@dasyatidae.com>]

Stefan Monnier wrote:
>> I’m adding more powerful features to crdt.el including buffer local variable
>> synchronizations and arbitrary remote command/function call,
> 
> Given the way Emacs is designed/structured this is a recipe for big
> gaping security holes.  It can be OK to allow such things for *very*
> specific cases (a few specific well understood variables), but even such
> a "whitelist" is a problem because it requires careful and
> long term maintenance.
For the buffer-local variables specifically, we do already have
safe-local-variable-p which might cover a number of cases---and
that's already used for loading variables from untrusted files.
That said, that mechanism is still dangerous on an absolute scale
and has had security holes in the past (one of which I PoC'd and
reported myself decades ago, though I can't find it now).

Remote commands would be even more dangerously tricky to get right,
especially in the absence of ground-up infrastructure for it.

-RTT