<div dir="ltr">Thanks David, this seems quite a useful app for people on Windows, but I did not find out whether it can be used as a console command: the documentation seems to imply that one needs to run its GUI, which is not gonna work for Opam...<div><br></div><div>Maybe also on Windows we should stick to LD_PRELOAD, but I never tried that in practice... I wonder whether it will work with the cygwin/mingw toolchain.</div></div><div class="gmail_extra"><br><div class="gmail_quote">2015-02-23 10:09 GMT+01:00 David Allsopp <span dir="ltr"><<a href="mailto:david.allsopp@metastack.com" target="_blank">david.allsopp@metastack.com</a>></span>:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div class="HOEnZb"><div class="h5">Roberto Di Cosmo wrote:<br>
> On Mon, Feb 23, 2015 at 10:07:58AM +0900, Louis Gesbert wrote:<br>
> > That's starting to sound fairly consistent:<br>
> ><br>
> > # Secure OPAM itself a bit:<br>
> ><br>
> > * Sandbox the build step: not sure how to do it, but it should be<br>
> without network access, and only allowed to write to its build dir.<br>
><br>
> This is really *not easy* in the current state of affairs<br>
><br>
> -> opam calls whatever command is declared in the build:/install: fields<br>
><br>
> -> this command can do whatever it wants; a sloppy Makefile might very<br>
> well end<br>
> up removing all the user-writeable files on a machine; think of<br>
> something like<br>
><br>
> PREFIX=$(HOME)/$(MYNICELOCALVAR) # ooops ... using a var defined<br>
> only on the dev machine!<br>
><br>
> install:<br>
> rm -rf $(PREFIX) # clean up dest dir on the dev machine; rm -rf<br>
> $(HOME) everywhere else!<br>
> ....<br>
> -> it's easy to pass through the integration test on opam-repository too:<br>
> if<br>
> somebody really wants to make bad jokes, one can simply check the<br>
> environment to be nice when going through Travis, and wreak havoc<br>
> elsewhere<br>
><br>
> In the GNU/Linux distribution world, we face a similar challenge, with<br>
> install scripts being on top run as root; the very stringent QA process<br>
> enforced by these communities mitigates the problem quite a bit, of<br>
> course, but it is still there and s*it happens.<br>
><br>
> That's why I was asking for the characteristics of the sandboxing<br>
> techniques we known. As with security, "sandbox" is a term easy to use,<br>
> but difficult to achieve.<br>
><br>
> My best bet is _really_ the ptrace approach followed by Mcqueen in<br>
> <a href="http://robot101.net/files/trace.tar.gz" target="_blank">http://robot101.net/files/trace.tar.gz</a> as it allows to monitor _all_ file<br>
> access even by statically linked binaries, and is able to make a backup<br>
> copy of modified files (to restore them, if something goes wrong).<br>
><br>
> What I do not know is whether something similar is available for *BSD, and<br>
> even less for Windows.<br>
<br>
</div></div>See <a href="http://www.sandboxie.com/" target="_blank">http://www.sandboxie.com/</a> for Windows.<br>
<span class="HOEnZb"><font color="#888888"><br>
<br>
David<br>
</font></span></blockquote></div><br><br clear="all"><div><br></div>-- <br><div class="gmail_signature"><div dir="ltr"><div>Roberto Di Cosmo</div><div> </div><div>------------------------------------------------------------------</div><div>Professeur En delegation a l'INRIA</div><div>PPS E-mail: <a href="mailto:roberto@dicosmo.org" target="_blank">roberto@dicosmo.org</a></div><div>Universite Paris Diderot WWW : <a href="http://www.dicosmo.org" target="_blank">http://www.dicosmo.org</a></div><div>Case 7014 Tel : ++33-(0)1-57 27 92 20</div><div>5, Rue Thomas Mann </div><div>F-75205 Paris Cedex 13 Identica: <a href="http://identi.ca/rdicosmo" target="_blank">http://identi.ca/rdicosmo</a></div><div>FRANCE. Twitter: <a href="http://twitter.com/rdicosmo" target="_blank">http://twitter.com/rdicosmo</a></div><div>------------------------------------------------------------------</div><div>Attachments:</div><div>MIME accepted, Word deprecated</div><div> <a href="http://www.gnu.org/philosophy/no-word-attachments.html" target="_blank">http://www.gnu.org/philosophy/no-word-attachments.html</a></div><div>------------------------------------------------------------------</div><div>Office location:</div><div> </div><div>Bureau 320 (3rd floor)</div><div>Batiment Sophie Germain</div><div>Avenue de France</div><div>Metro Bibliotheque Francois Mitterrand, ligne 14/RER C</div><div>-----------------------------------------------------------------</div>GPG fingerprint 2931 20CE 3A5A 5390 98EC 8BFC FCCA C3BE 39CB 12D3 </div></div>
</div>