Re: Arbitrary Sandbox

[Robert A Duff <bobduff@shell01.TheWorld.com>]

"Dmitry A. Kazakov" <mailbox@dmitry-kazakov.de> writes:

> Consider design of a container library in Ada, which cannot broken whatever
> the client does. I think it is possible to achieve with the corresponding
> modifications of the language and appropriate hardware support.

We have appropriate hardware support.  You can isolate that container in
its own process, and allow communication with it via (say) the
Distributed Systems Annex.  In the (unlikely) absence of compiler bugs,
OS bugs, hardware bugs, and bugs in the container itself, you can
ensure that client bugs (or malicious clients) don't break your
container.

That's inefficient, which was part of my claim:  If you allow things
like U_C of pointers, and rely on hardware to prevent problems,
that hardware (and related software support) is going to be
inefficient.

Or you can go the pure-Java route (no JNI).  Then in the absence
of compiler (etc.) bugs, you can ensure that client bugs won't
break your container.  But that's not a complete solution, because
you can't write (for example) the garbage collector in Java -- you
*need* to do unsafe things in a GC.  And implementing the GC in
hardware won't magically make it bug-free, nor efficient.

- Bob