Porting security from Java/.NET to PHP

Question

This probably a rather naive question given my limited knowledge in the code I've been looking at, but I want to get my head around it before I start diving into writing actual code myself.

I'm writing a common set of tools for PHP and most of my inspiration has come from the .NET framework. The ironic thing is that I have never used the .NET framework, but I do understand C# and can therefore port the concepts I "do" understand from Mono.

But I have run into a bit of a wall, System.Security. As I browse over the API docs, and the Mono security implementations on Github, I quickly feel like none of features could ever be applied to PHP. My current confusion is as follows:

PermissionSet ps1 = new PermissionSet(PermissionState.None);
ps1.AddPermission(new FileDialogPermission(FileDialogPermissionAccess.Open));
Console.WriteLine(ps1.ToXml().ToString());

So here is a basic example. What I want to do in PHP is create an application partially governed by permissions on the "environment" level. That is to say, one machine shouldn't be able to perform certain actions that another might. For instance, machine A, shouldn't be allowed to TCP to machine B.

But when I look at the code in the example, I don't really understand why it makes any difference. My current understanding is that this is not "setting" the permissions, but "checking" them. And the permission itself is predefined somewhere else, I.E. in the machine.

I have looked over Java's implementation of the same feature, and side by side .NET looks a lot more in-depth. I would like to incorporate this concept into my own PHP code, but right now I don't know how I would do it.

Are the permissions entirely arbitary? does .NET "impose" restrictions? or simply provide security diagnostics to the application? If the last one is true, then porting to PHP is not only possible, but may actually be quite useful. However I know that in PHP, the second one is impossible.

Could someone please clear up what the Java and .NET security namespaces do, and give me an idea of how feasible it is to port to other languages.

Answer 1

Every language has a runtime which connects your code with the outside world. In the case of Java and .NET, this runtime includes a security model. E.g. if a Java application wants to open a file, that request has to pass through the runtime. The runtime can then deny that request. Note that this is not implemented on a library level within the language, but on a language implementation level. From within the runtime, you can only check what you are allowed to do, but not grant yourself new permissions.

Therefore, you can't just implement a security model in another language: you security layer would need some way to perform the security-sensitive action, but that same way would be available to any other code in that language, so your security layer could be bypassed. Instead, this security model needs to be in the runtime itself (in the case of PHP, this would be the interpreter in the default implementation).

I have seen one exception: Perl's Safe module can control which opcodes are available to a piece of code being compiled, which can serve as a coarse sandbox. Here, the runtime doesn't itself provide the security model, but the dynamic nature of the runtime is exploited to implement a security model on top of it.

PHP does have a couple of sandboxing mechanisms: E.g. Runkit can restrict the functions that can be called by a sandboxed piece of code. A common sandboxing technique is also to override built-in functions by versions that check permissions, but that only works as long as there is no way to get the original version back. This can be a viable approach when rewriting compiled code to be sandboxed, but rewriting-based security approaches are prone to miss obfuscated calls.