Improve sandboxing to allow more granular permissions about janet HOT 11 OPEN

I'm mainly interested in laying some groundwork for a more granular permission model so that it could maybe later be also exposed in janet's cli.
I'm mainly inspired by deno's permission model and think that janet's good fit for scripting could benefit from that.

from janet.

sandboxing is a task that should be done by the operating system.

from janet.

I think this is the kind of thing that's best written as an external tool. You could write such a tool in janet and C.

However, I already have firejail and apparmor for that. I don't want to reinvent wheels.

from janet.

My assessment is that this is best done as an external janet library that sandboxes a janet function....

Or, it goes into spork... I don't know whether it's possible to sandbox janet.... from within...

from janet.

At least some of what is proposed seems like reasonable extensions to the existing sandbox function.

On a side note, as an example of a concrete use case, the sandbox feature was already put to good use by @AlecTroemel in the Janet support for TIC-80 to improve the security situation. See this PR if interested.

from janet.

Janet's own sandboxing should not conflict with external sandboxing by things like firejail, SELinux, and apparmor.

If janet does its own sandboxing, I want to impose more restrictions through firejail and apparmor.

from janet.

I'm worried that granular internal sandboxing will make janet bloated....

from janet.

Whitelisting approach will force janet to carry lists of common whitelisted paths. Apparmor and firejail carry such lists.

Even apparmor can't block outgoing network connections by hostname. I don't know whether SELinux can do that.

Apparmor can allow unix domain sockets by paths. It can't allow network connections by IP addresses or hosts.

from janet.

I'm mainly interested in laying some groundwork for a more granular permission model so that it could maybe later be also exposed in janet's cli.

If you want this to be configured in command line options, then you should probably just use firejail or apparmor....

If janet ever does this, only sandboxing API makes sense. Landlock is linux sandboxing API.

You really don't want to specify granular permissions on command line unless command line options are constructed programmatically. You want something like a firejail/apparmor profile for granular permissions.

from janet.

allow specifying a list of allowed hosts for networking connections during sandboxing (subdomains might be allowed or not based on input)

That's the job of firewall. Even SELinux doesn't block outgoing network connections by hosts or IP addresses.

from janet.

allow limiting file access by capability (read, read/write etc.)

This is what apparmor does with profiles..... I really don't want to write verbose permissions on command line.....

from janet.