Re: sandboxing untrusted code

Robert Haas <robertmhaas(at)gmail(dot)com> writes:
> ... One of the worst things for a security system to do is be
> so annoying that users turn it off, and blocking stuff that a human
> will immediately identify as harmless is a quick route to that goal.

Right. I'm reminded of SELinux, which in its early incarnations
was definitely in the category of "too annoying for normal users".
Red Hat spent literally years sanding down the rough edges, and
since then it's been on-by-default on just about every RH-based
machine, with few problems. Don't underestimate the amount of
effort needed to get to that status.

I was only on the periphery of that work, but from what I recall,
the years of fine-tuning were less about the core mechanisms than
about developing a set of policies that didn't get in people's way.
The corresponding labor here would probably be refining our ideas
about which sets of functions to distinguish and making sure that
all the functions are correctly classified.

regards, tom lane