Mailing-List: contact dev-help@couchdb.apache.org; run by ezmlm
Precedence: bulk
Reply-To: dev@couchdb.apache.org
Received-SPF: pass (athena.apache.org: domain of bchesneau@gmail.com
 designates 209.85.210.175 as permitted sender)
MIME-Version: 1.0
In-Reply-To: 
 <CAN-3CBJBtVmsvO=bQQ_aXRvnMGvaNat1oJK2gXphL=DDpfCChg@mail.gmail.com>
References: 
 <CAN-3CBK3Pq3=kTy82T4LR3Fr27k_u-=QFSo2VRwKHnw4fC-eTg@mail.gmail.com>
	<CAKmKYaCUgd+oxyjP4BcOXz94_2OJOB6du_1hF-nS30EtMGaY0A@mail.gmail.com>
	<CAN-3CBLtSwGSQ8JxMGjFSfAtGOWtr1gjJdvdVRYcsDg3a2-ogw@mail.gmail.com>
	<5102B439.10500@lymegreen.co.uk>
	<CAN-3CBK+yWV0oQX7f1Hsj0XpORvrjpJ7dmEhn4bpHLryKDVmAw@mail.gmail.com>
	<CAFUSCh_knsU-yg-bBu0v8Labq11tYJfcTB1VLrGvFNJkE4YpLQ@mail.gmail.com>
	<CAN-3CBLS_iQJB=n7VVHJ288OOu+5JO-6oJwR=760KmwKE9huQQ@mail.gmail.com>
	<CAFUSCh9zoCvJU638s7n72+oAmJMSzmM9+oett-=Hiccx-hwjhw@mail.gmail.com>
	<CAN-3CBKMdDK7uv4-pKJn5ziPU=my23jXA6S0SQNAP+Jw2bHsow@mail.gmail.com>
	<CAJNb-9oVW9AfngCmd7bJjU34pqsouxYtScAhqCB5p0zUXh6obw@mail.gmail.com>
	<CAJ_m3YCDEtQ8HKSZ8q1uCBaP5Gg08pUxv+4-kX_+xQfjPgt3Hw@mail.gmail.com>
	<CAL+Y1nsoN-voZBexDVO3_xNAdy318uyazXsLyezB2U9vbvv-fQ@mail.gmail.com>
	<CAN-3CBLhsi2hG1XXOFgZNXYq+1Nm8Rb7Gsvq=tmTPaLYO_2r4g@mail.gmail.com>
	<CAAL6JQjUY9C9K7RfjVYJm-kGwNXq4vWEPJti2_bho_FPA9ukTg@mail.gmail.com>
	<CAN-3CBJgfE1CF4sK_dQWS1sQQNiKyecgSpwViOQZfHSvdOcczw@mail.gmail.com>
	<CAJNb-9rsLXNafZty0PTJ3NNLLGMrjfAPbT8v06cSXH=YXsYnEg@mail.gmail.com>
	<CAN-3CB+NDKbWFuXRJ16X5Lv5yF59LpasgzrpJe1sqp-v0YvNBg@mail.gmail.com>
	<CAJNb-9oKme7ALBCu9ba=qg9n3nhvk7n4Q-kdYgKC3MzzNJ5XGw@mail.gmail.com>
	<91019D9B-A6AE-4311-9C11-E6001D57293A@apache.org>
	<CAN-3CBLnHMMjJjRVvd249ozaUWjYpTc2QjbkELs+cQs5SfAXug@mail.gmail.com>
	<CAJNb-9porEGSqUci+eHX434RzZhKXQq7EfDCgXtdGFjZFPHSMA@mail.gmail.com>
	<CAN-3CBJBtVmsvO=bQQ_aXRvnMGvaNat1oJK2gXphL=DDpfCChg@mail.gmail.com>
Date: Mon, 4 Feb 2013 11:53:47 +0100
Message-ID: 
 <CAJNb-9o1CAWVO4FsMmKEL6oQJHX-vsd==r_oMyDyXp5mLqFR=A@mail.gmail.com>
Subject: Re: Branch to switch from SpiderMonkey to Node.js
From: Benoit Chesneau <bchesneau@gmail.com>
To: "dev@couchdb.apache.org" <dev@couchdb.apache.org>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable

On Thu, Jan 31, 2013 at 5:54 PM, Jason Smith <jhs@iriscouch.com> wrote:
>
> On Thu, Jan 31, 2013 at 4:34 PM, Benoit Chesneau <bchesneau@gmail.com>wro=
te:
>
> >
> > A javascript engine doesn't expose any IO par default. The **framework*=
*
> > nodejs is, this is all the point. I'm quite interested by the existing
> > solutions to sandbox nodejs, do you know some projects that does it?
> >
>
> Correct. I am attempting to build something which satisfies your
> description: no i/o; i/o is not even possible.
>
> *How* is it implemented? Well, it doesn't matter whether we use Node.js o=
r
> couchjs/SM or couchjs/v8. What matters is we feel confident about securit=
y.
> And of course, I agree, if we cannot achieve good security, then that is =
a
> show stopper.
>
> Here is my current plan for sandboxing CouchJS. (Thanks to Isaac for his
> tips.)
>
> When it is time to evaluate some code:
>
> 1. Set up an object with safe variable bindings: safe_context
> 2. fork()
> 3. Child process runs vm.runInNewContext(safe_context)
> 4. Child process communicates to the parent over stdio, through the
> approved safe_context functions
>
> The subprocess can also give extra sandboxing, such as chroot() if
> available.
>
> Yes, this causes two processes per instantiation; however I think the
> parent might only be short-lived, setting up the security, then exiting.
> The grandchild can talk to Erlang over stdio.
>
> That is my plan. No idea how well it will work.
>
> --
> Iris Couch


Too much kool-aid imo :)

This is not that it can't work. But are you seriously considering to
have a main couchjs process maintaining the STDIO channel and spawn a
new OS Process for a view (which what does  `vm.runInNewContext`)? The
memory and latency cost can became very important, and i don't count
the chrooting cost especially if run this context on each indexation
batch or shows, lists and views requests. + the extra fds created by
each child contexts.

Anyway, I looked over the week-end and didn't find so may other
solutions when it's about nodejs. I read that and maybe `
vm.runInContext` [1] with `vm.CreateContext` could work or like Klaus
says maybe `vm.CreateScript` though the doc[1] don't say if it s in
the same process or not [2]. I guess it is. I'm interested by the
solution of providing a secure "require" like suggest Klaus. How would
it work?

I intend to write a straight-forward port of couchjs to use v8 to see
how much things it gave us, but it will be just a temporary hac, just
good for 1.4 imo. I also would like to find a solution for the mobile
worl and i'm not sure v8 is OK for that yet.

Just some thoughts, it's cool to see such activity on this topic :)

- beno=EEt


[1] http://nodejs.org/api/vm.html#vm_vm_createcontext_initsandbox
[2] http://nodejs.org/api/vm.html#vm_vm_createscript_code_filename
[3] http://nodejs.org/api/vm.html#vm_sandboxes