guile --listen

[Andy Wingo <wingo@pobox.com>]

Hello all,

I implemented a module, (system repl server), which exports routines to
listen on a socket for connections, and serve repls to clients, one
thread per client. The server can also be in a different thread.

I set the default socket type to TCP (on localhost only), and the
default port to be 37146. It sort of looks like "GUILE" if you look at
it upside down. But it's many digits, so if anyone has a different
preferred default port we can change that.

Now, to step somewhat more controversially... I added a command-line
option to Guile, --listen, which will cause Guile to listen on a socket
while it is running. You can --listen=1234 to set a specific port, or
--listen=/tmp/foo-socket to use a unix domain socket (though currently
we don't clean up that socket, which is probably a bug) or just --listen
to listen on localhost:37146.

The point is to allow any Guile program to easily add a backdoor. Of
course it's amusing to be able to "nc localhost 37146" and get a repl,
but I figured it will be best with Jao's Geiser emacs mode
(http://www.nongnu.org/geiser/). You can just tell emacs to connect to a
given port and there you are, hacking on your web server. With a
suitable SSH tunnel you could hack on your live web server that way.

Security-wise, using a localhost address can result in local users being
able to do anything your process can do, but for some use cases that's
OK. Presumably you are using some restricted user or something, and if
people have a local user I'm sure there's myriad kernel holes that are
more interesting than a Guile shell. Anyway, it's off by default, so it
shouldn't matter.

With Unix domain sockets you can do more permissions-type stuff, but
I'm not sure if Emacs' comint works with unix sockets.

Anyway, that's the deal. Carp now if the whole idea is offensive to you,
and perhaps we can take out the command-line arg. It would be nice to
be able to make any long-running Guile application hackable just with a
command-line argument, though :)

Cheers,

Andy
-- 
http://wingolog.org/