11–20 of 158 posts
Except the vulnerability was a stack up. The logger wasn't making network calls per se, but passing requests to a component (JNDI) that would obviously need network access. You'd have the same root issue, it'd just manifest more as sort of a confused deputy with a capability based model.
Why should a programming language be limiting network access? Why wouldn't we do this via the operating system?
It seems more practical to use BSD’s approach of pledging once in main that the process won’t access the network. Parts of the program that need different capabilities are isolated in their own processes and communicated with using IPC. I don’t think people want to pass all kinds of capabilities around in every function call.
Sounds better in general, but probably wouldn't help with something like logging which would probably be used in all the processes. Unless you want to make IPC calls for every logging call.
https://docs.oracle.com/javase/tutorial/essential/environmen...
It seems more practical to use BSD’s approach of pledging once in main that the process won’t access the network. Parts of the program that need different capabilities are isolated in their own processes and communicated with using IPC. I don’t think people want to pass all kinds of capabilities around in every function call.
Sounds better in general, but probably wouldn't help with something like logging which would probably be used in all the processes. Unless you want to make IPC calls for every logging call.
Isn't this more or less what ends up happening anyway? Sure, from the application's perspective it's just a function call. But usually, in the end, the logs are shipped to some central location one way or another.
- Somewhere between too confusing/frustrating to developers (especially ASP.NET ones, where often the escape hatch of 'AllowPartiallyTrustedCallersAttribute' would get thrown around)
- Hard to manage from a per-app granularity standpoint.
Edit, hit the post button too early:
In any case, this behavior wound up getting changed to be a lot more forgiving in .NET 4 (although, often in fact requiring the removal of the aforementioned APTCA from your web projects,) and IIRC it's gone in Core.
Why should a programming language be limiting network access? Why wouldn't we do this via the operating system?
It might be useful that some code in a single process have access while other parts do not. How would you propose an OS handle those cases?
Why should a programming language be limiting network access? Why wouldn't we do this via the operating system?
Programming language can know more about the program's (intended) state at any given time. The OS can/should frequently be involved, but even then you're frequently doing something like pledge() from the program to let the OS know when/how to restrict you. Doing it totally externally, like SELinux does, is valuable but coarser-grained.
(A subtlety here is that you may want authority to write to a network filesystem.)
Earlier quoted context omitted.
It might be useful that some code in a single process have access while other parts do not. How would you propose an OS handle those cases?
I don't think that's particularly useful though. A program with requirements like that seems more likely to be split up into two independent pieces.