Re: E patches for review: ELoader, FileGetter

On May 24, 2010, at 14:14, Thomas Leonard wrote:

> What are the security implications? e.g. say I have a file like this:
>
> # securePair.emaker
> interface FooGuard guards FooAuditor { }
> [FooGuard,FooAuditor]
>
> Before, another emaker could import this and use FooAuditor. If anyone
> else imported it, they just got a new copy and no harm done. Now, that
> same code would be insecure.
>
> I don't think I've seen any code like this, but maybe there are more
> subtle cases?


It has always been the expectation that <import:foo> is not a  
significant authority by itself whereas <import:foo>() (when foo =  
makeBar) is. As far as I know, there is no emaker in any E  
implementation or application which relies on the fact that they are  
multiply instantiated.

The multiple instantiation is simply a mechanism to ensure that  
<import> does not become a communication channel between separate  
confined components that works despite our lack of DeepFrozen auditing.

-- 
Kevin Reid                                  <http://switchb.org/kpreid/>