Re: Specification for Trusted PLs?

On 5/23/2010 6:14 PM, Ron Mayer wrote:
> Tom Lane wrote:
>> Robert Haas <robertmhaas(at)gmail(dot)com> writes:
>>> So... can we get back to coming up with a reasonable
>>> definition,
>>
>> (1) no access to system calls (including file and network I/O)
>
> If a PL has file access to it's own sandbox (similar to what
> flash seems to do in web browsers), could that be considered
> trusted?

That is a good question.

Currently, the first of all TRUSTED languages, PL/Tcl, would allow the
function of a lesser privileged user access the "global" objects of
every other database user created within the same session.

These are per backend in memory objects, but none the less, an evil
function could just scan the per backend Tcl namespace and look for
compromising data, and that's not exactly what TRUSTED is all about.

In the case of Tcl it is possible to create a separate "safe"
interpreter per DB role to fix this. I actually think this would be the
right thing to do.

Jan

--
Anyone who trades liberty for security deserves neither
liberty nor security. -- Benjamin Franklin