Re: Might --enable-compile-inits make things more secure?

Hello Chris,

thank you for your explanatory reply.
It is much appreciated because it helps me a lot
to better understand things (at least in a basic way).


On Dec 12 13:24 Chris Liddell wrote (excerpts):
> Postscript can easily handled as a byte stream,
> but PDF is a random access format

Ouch!
I forgot about PDF - that could be severe problem.
I better won't publish here my personal opinion
about non-streamable portable document formats
(the "non-streamable portable" contradiction is intentional)
where the most interesting parts come at the very end
(except jokes or mystery stories ;-)

My crucial point behind my idea is to let those restrictions
only happen when a Ghostscript option is set (like -dSAFER)
so that users who actually need to run Ghostscript without
those restrictions can do it but then the user must trust
the PostScript or PDF input.

Perhaps for really strict security restrictions a separated
Ghostscript option like -dRESTRICTED (whatever name you like)
could be used.


> Ghostscript uses temporary files - so still using the disk

Not necessarily.

With -dSAFER or -dRESTRICTED set all temporary data could be
stored in memory which of course fails when huge temporary
data needs to be stored but that's the price for being safe
(bye-bye processing huge PFDs that are not streamable on
a small system and being safe, cf. RFC 1925 items 7a and 9).

I think on nowadays systems /tmp/ is often a tmpfs, cf.
https://en.opensuse.org/openSUSE:Tmp_on_tmpfs
where temporary data is already stored in memory so that
on nowadays systems there should be no diffrence when
Ghostscript stores its temporary data directly in memory
instead of via /tmp/ on tmpfs in memory.


> Ghostscript needs to be able to read the font files from disk.

With -dSAFER or -dRESTRICTED set all needed data would have
to be included in the PostScript or PDF input for being safe.
Otherwise simply run Ghostscript unrestricted and pray ;-)


> Postscript spec includes the facility to read/write/interpret files

Of course and when such PostScript features are needed
Ghostscript must be run in unrestricted mode.


Bottom line:
What I am basically asking for is a merciless restricted mode
where security takes precedence over "it just works",
cf. "Security: Make Things Not Just Work" in
https://en.opensuse.org/SDB:CUPS_and_SANE_Firewall_settings


Kind Regards
Johannes Meixner
-- 
SUSE LINUX GmbH - GF: Felix Imendoerffer, Jane Smithard,
Graham Norton - HRB 21284 (AG Nuernberg)