<br><br><div class="gmail_quote"><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><div class="im"><br>
</div>I don't really understand. The only (legal) way to modify the beam<br>
is to change the source and recompile. I think you have to<br>
decide exactly what the semantics of require are.</blockquote><div><br></div><div>I'm actually most concerned about the illegal way of modifying a beam: </div><div><br></div><div>a.) Sysadmin gets clever an runs rsync patching the beam with a diff from one on another server (bad if that server doesn't have the right version)</div>
<div>b.) Developer gets clever and uses source control as a deployment mechanism, "git push production master", overriding the version there</div><div>c.) Nefarious type replaces beams with other beams that have been compiled with compromised security built in</div>
<div><br></div><div>having a loader that can check at run time (late binding)</div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
a) We check the require targets *before* compilation with<br>
a separate program<br></blockquote><div><br></div><div>rebar (<a href="http://github.com/basho/rebar">http://github.com/basho/rebar</a>) already does a pretty good job at this (as long as you list all your dependencies as git repos) and I've been making heavy use of this over the past year. It handles checking out and compiling all the dependencies, and you can specify which specific tags you depend upon.</div>
<div><br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"> c) we check at usage time. The first time we call daves_module and find</blockquote><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">
it has not been loaded we check the cache and so on<br></blockquote><div> </div><div>Right now I'm most worried about c.) in the context of lib/kernel/src/code_server.erl:</div><div><br></div></div><blockquote class="webkit-indent-blockquote" style="margin: 0 0 0 40px; border: none; padding: 0px;">
<div class="gmail_quote"><div><div>try_load_module(Mod, Dir, Caller, St) -></div></div></div><div class="gmail_quote"><div><div> File = filename:append(Dir, to_path(Mod) ++</div></div></div><div class="gmail_quote">
<div><div> objfile_extension()),</div></div></div><div class="gmail_quote"><div><div> case erl_prim_loader:get_file(File) of</div></div></div><div class="gmail_quote"><div><div> error -></div>
</div></div><div class="gmail_quote"><div><div> {reply,error,St};</div></div></div><div class="gmail_quote"><div><div> {ok,Binary,FName} -></div></div></div><div class="gmail_quote"><div><div> try_load_module(absname(FName), Mod, Binary, Caller, St)</div>
</div></div><div class="gmail_quote"><div><div> end.</div></div></div></blockquote><div class="gmail_quote"><div><br></div><div>Where the file pointed to by FName is now "trusted" and will then be read into memory and passed off to hipe.</div>
<div><br></div><div>Part of the problem is I'm also introducing a new risk, because I'm replacing this load bit with code that can read a URL rather than just a filename, so I'd like a way to hook in to check that the file I've downloaded is the same as the signature I have on file in a dets store.</div>
<div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;">Good stuff - needs some thought though. I was thinking of signing/validating<br>
the source with an RSA public/private keypair.<br></blockquote><div><br></div><div>I've thought about adding RSA public/private key signing, but that ultimately goes down the route of having a CA to form a trust network, and since CAs tend to prove to be unworthy of trust, I'm wary. Self publishing a RSA public key + signing a SHA hash of the source and putting both in DNS seems like a reasonable way of doing it, but can also be exploited to deny service by DNS cache poisoning. </div>
<div> </div><div>If one were to implement a pub/private key signature check, would it best be done in code_server.erl or somewhere else? That seems to be the first place the files are loaded into memory at run time.</div>
<div><br></div><div>Dave</div><div> </div></div>-- <br>-=-=-=-=-=-=-=-=-=-=- <a href="http://blog.dloh.org/">http://blog.dloh.org/</a><br>