Re: [9front] [PATCH] kernel: disallow executing from #| or #d

[Jacob Moody <moody@mail.posixcafe.org>]

On 5/10/22 08:40, ori@eigenstate.org wrote:
> I think all files should be the same, as much as
> they can be -- we shouldn't necessarily need to
> care if we have a pipe or not.
> 

In general I think I agree, but I would argue that its not the
exec code that is special casing itself from using these files.
The devices are electing themselves to say that execution is
not a supported operation on the files they serve, but perhaps
that is just semantics.

I want to explain more of why I think this is not ideal. I am
approaching this from the question "what capabilities does a sharp
device give you?". And I think it is a bit surprising to say access
to #| or #d also gives a process the ability to execute arbitrary code
stashed in to one end of a pipe. I can imagine such a case of building
a namespace where the binaries exposed are hand picked, and I think its
reasonable to want to restrict what binaries can be executed while also
allowing programs to use dup() and pipe().

But perhaps my approach here is wrong, it could be that it is inherently misleading
to think about a programs capabilities in terms of what kernel devices
the program has access to.


moody