1

This probably a rather naive question given my limited knowledge in the code I've been looking at, but I want to get my head around it before I start diving into writing actual code myself.

I'm writing a common set of tools for PHP and most of my inspiration has come from the .NET framework. The ironic thing is that I have never used the .NET framework, but I do understand C# and can therefore port the concepts I "do" understand from Mono.

But I have run into a bit of a wall, System.Security. As I browse over the API docs, and the Mono security implementations on Github, I quickly feel like none of features could ever be applied to PHP. My current confusion is as follows:

PermissionSet ps1 = new PermissionSet(PermissionState.None);
ps1.AddPermission(new FileDialogPermission(FileDialogPermissionAccess.Open));
Console.WriteLine(ps1.ToXml().ToString());

So here is a basic example. What I want to do in PHP is create an application partially governed by permissions on the "environment" level. That is to say, one machine shouldn't be able to perform certain actions that another might. For instance, machine A, shouldn't be allowed to TCP to machine B.

But when I look at the code in the example, I don't really understand why it makes any difference. My current understanding is that this is not "setting" the permissions, but "checking" them. And the permission itself is predefined somewhere else, I.E. in the machine.

I have looked over Java's implementation of the same feature, and side by side .NET looks a lot more in-depth. I would like to incorporate this concept into my own PHP code, but right now I don't know how I would do it.

Are the permissions entirely arbitary? does .NET "impose" restrictions? or simply provide security diagnostics to the application? If the last one is true, then porting to PHP is not only possible, but may actually be quite useful. However I know that in PHP, the second one is impossible.

Could someone please clear up what the Java and .NET security namespaces do, and give me an idea of how feasible it is to port to other languages.

1

Every language has a runtime which connects your code with the outside world. In the case of Java and .NET, this runtime includes a security model. E.g. if a Java application wants to open a file, that request has to pass through the runtime. The runtime can then deny that request. Note that this is not implemented on a library level within the language, but on a language implementation level. From within the runtime, you can only check what you are allowed to do, but not grant yourself new permissions.

Therefore, you can't just implement a security model in another language: you security layer would need some way to perform the security-sensitive action, but that same way would be available to any other code in that language, so your security layer could be bypassed. Instead, this security model needs to be in the runtime itself (in the case of PHP, this would be the interpreter in the default implementation).

I have seen one exception: Perl's Safe module can control which opcodes are available to a piece of code being compiled, which can serve as a coarse sandbox. Here, the runtime doesn't itself provide the security model, but the dynamic nature of the runtime is exploited to implement a security model on top of it.

PHP does have a couple of sandboxing mechanisms: E.g. Runkit can restrict the functions that can be called by a sandboxed piece of code. A common sandboxing technique is also to override built-in functions by versions that check permissions, but that only works as long as there is no way to get the original version back. This can be a viable approach when rewriting compiled code to be sandboxed, but rewriting-based security approaches are prone to miss obfuscated calls.

  • Thanks for your answer. It sounds to me as though implementing this feature in PHP may be not be useful, or even practical. Your example regarding restricting function calls is not something that would need to be checked on server side code where most of the features are only under administrative control. Just to clarify that point though, in an environment such as ASP.NET running under IIS, do permission checks have any place in an application (server) whose primary purpose is to serve web pages? In other words, is code access ever needed to be checked in a secured environment? – Flosculus Aug 16 '15 at 21:37
  • @Flosculus In some Wiki systems or Webapps, there might be user-supplied code that must be sandboxed. However, sandboxes are more important on the Desktop. Java was developed with the expectation that “applets” would catch on: small programs that could be downloaded from the web and be safely run in a sandbox. That dream has been shattered w.r.t. Java, Silverlight, and Flash, but JavaScript continues to be a popular sandbox environment on the web, due to a different set of tradeoffs. – amon Aug 16 '15 at 21:50
  • I understand. Also after looking up the CAS system on dotnet/corefx and finding nothing but references to its deprecation, it doesn't look like something I need to worry about. Thanks again, you probably saved me many hours of wasted time lol – Flosculus Aug 16 '15 at 21:55

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.