April 2017 - Pharo-dev - lists.pharo.org

Re: [Pharo-dev] Security in the image

by Denis Kudriashov

2017-04-12 18:32 GMT+02:00 Ben Coman <btc(a)openinworld.com>: > If you want hostile actors working directly within the Image with a full > environment, then Pharo is probably not suitable. Its easy to get hold of > global class from the Playground references and overwrite/compile any > method in the system like this... > > SomeClass compile: 'initialize > MyEvilHack dostuff. > ^ super initialize ' > > You might want to consider Newspeak, which runs on the same VM as Pharo > and has a focus on security. > Interesting how they address your example?

April 13, 2017

Re: [Pharo-dev] Please, test our 64bits builds

by Alistair Grant

Hi Thierry, On Wed, Apr 12, 2017 at 07:33:21PM +0200, Thierry Goubier wrote: > Hi Alistair, > > for that I switch to OSProcess when on Pharo 64 bits. > > Regards, > > Thierry Thanks, that's working. Cheers, Alistair

April 13, 2017

Re: [Pharo-dev] Security in the image

by LaeMing

Ben Coman wrote > On Wed, Apr 12, 2017 at 3:34 PM, LaeMing < > laeming@.com > > wrote: > >> Hi, I am fishing about for an environment to try to develop a simple >> virtual >> world system in (yes, I'm aware of croquet/cobolt!). >> >> In a smalltalk-like environment, that might conceivably involve inviting >> multiple people into the 'image' where the world is hosted to interact >> with >> objects within it (if I was to use a smalltalk, it would want it to >> interleave the entire system, not just host it on top.) >> >> What sort of security implications might that have and are there any >> current >> solutions to a multi-user single-image situation? >> > > If you want hostile actors working directly within the Image with a full > environment, then Pharo is probably not suitable. Its easy to get hold of > global class from the Playground references and overwrite/compile any > method in the system like this... > > SomeClass compile: 'initialize > MyEvilHack dostuff. > ^ super initialize ' > > You might want to consider Newspeak, which runs on the same VM as Pharo > and > has a focus on security. > * https://www.slideshare.net/esug/8-gilad-brachaesug08 > * https://www.youtube.com/watch?v=UwkROn7OmNQ > > cheers -ben Thanks, Ben. I am looking into Newspeak now. I am rather impressed so far! -- View this message in context: http://forum.world.st/Security-in-the-image-tp4941857p4941932.html Sent from the Pharo Smalltalk Developers mailing list archive at Nabble.com.

April 13, 2017

Re: [Pharo-dev] Security in the image

by LaeMing

Stephan Eggermont wrote > On 12/04/17 09:34, LaeMing wrote: >> What sort of security implications might that have and are there any >> current >> solutions to a multi-user single-image situation? > > Take a look at gemstone. > https://www.youtube.com/user/JamesGFoster/videos > Starting at https://www.youtube.com/watch?v=U0z5TddqyQI > James made a really good series of videos > > > Stephan Thanks, Stephan. Gem looks rather good, but I need an OSS licensed environment. -- View this message in context: http://forum.world.st/Security-in-the-image-tp4941857p4941931.html Sent from the Pharo Smalltalk Developers mailing list archive at Nabble.com.

April 13, 2017

Re: [Pharo-dev] Alien osVersion is not defined. Pharo 5

by nacho

Thanks Esteban I will look at that. ----- Nacho Smalltalker apprentice. Buenos Aires, Argentina. -- View this message in context: http://forum.world.st/Alien-osVersion-is-not-defined-Pharo-5-tp4941906p4941… Sent from the Pharo Smalltalk Developers mailing list archive at Nabble.com.

April 12, 2017

Re: [Pharo-dev] Please, test our 64bits builds

by Thierry Goubier

Hi Alistair, for that I switch to OSProcess when on Pharo 64 bits. Regards, Thierry Le 12/04/2017 Ã 19:08, Alistair Grant a Ã©crit : > Hi Esteban, > > On Wed, Apr 12, 2017 at 06:54:16PM +0200, Esteban Lorenzano wrote: >> >>> On 12 Apr 2017, at 18:43, Alistair Grant <akgrant0710(a)gmail.com> >>> wrote: >>> >>> Hi Esteban, >>> >>> On Wed, Apr 12, 2017 at 06:08:56PM +0200, Esteban Lorenzano wrote: >>>> forget to say that iceberg will not work 100% yet :) but here, >>>> problem is because you need to install the threaded version, which >>>> of course I forget to point :P >>>> >>>> curl get.pharo.org/64/60+vmTLatest | bash >>>> >>>> this is the correct one for linux users. >>> >>> Thanks, I'm successfully past the Metacello load. >>> >>> Next problem: >>> >>> PrimitiveFailed: primitive #integerAt:put:size:signed: in >>> ExternalAddress failed >> >> the OSSubprocess maintainer needs to adapt his sources, I guess??? we >> cannot provide automatic compatibility??? :) > > OK, thanks. Hopefully Mariano is listening. ;-) > > Cheers, > Alistair > > >

April 12, 2017

Re: [Pharo-dev] Please, test our 64bits builds

by Alistair Grant

Hi Esteban, On Wed, Apr 12, 2017 at 06:54:16PM +0200, Esteban Lorenzano wrote: > > > On 12 Apr 2017, at 18:43, Alistair Grant <akgrant0710(a)gmail.com> > > wrote: > > > > Hi Esteban, > > > > On Wed, Apr 12, 2017 at 06:08:56PM +0200, Esteban Lorenzano wrote: > >> forget to say that iceberg will not work 100% yet :) but here, > >> problem is because you need to install the threaded version, which > >> of course I forget to point :P > >> > >> curl get.pharo.org/64/60+vmTLatest | bash > >> > >> this is the correct one for linux users. > > > > Thanks, I'm successfully past the Metacello load. > > > > Next problem: > > > > PrimitiveFailed: primitive #integerAt:put:size:signed: in > > ExternalAddress failed > > the OSSubprocess maintainer needs to adapt his sources, I guess??? we > cannot provide automatic compatibility??? :) OK, thanks. Hopefully Mariano is listening. ;-) Cheers, Alistair

April 12, 2017

Re: [Pharo-dev] Please, test our 64bits builds

by Esteban Lorenzano

> On 12 Apr 2017, at 18:43, Alistair Grant <akgrant0710(a)gmail.com> wrote: > > Hi Esteban, > > On Wed, Apr 12, 2017 at 06:08:56PM +0200, Esteban Lorenzano wrote: >> forget to say that iceberg will not work 100% yet :) >> but here, problem is because you need to install the threaded version, which of course I forget to point :P >> >> curl get.pharo.org/64/60+vmTLatest | bash >> >> this is the correct one for linux users. > > Thanks, I'm successfully past the Metacello load. > > Next problem: > > PrimitiveFailed: primitive #integerAt:put:size:signed: in ExternalAddress failed the OSSubprocess maintainer needs to adapt his sources, I guessâ¦ we cannot provide automatic compatibilityâ¦ :) Esteban > > while executing: > > proc := OSSUnixSubprocess new > command: 'git'; > arguments: #('config' '--global' 'user.name' 'AlistairGrant'); > runAndWaitOnExitDo: [ :cmd :out :err | self assert: cmd isSuccess ]. > > I'm going to have to learn about FFI some time... > > Full stack below. > > I should have also added I'm on Ubuntu 16.04, and this obviously all > works fine in the 32bit VM / image. > > Cheers, > Alistair > > > > ExternalAddress(Object)>>primitiveFailed: > ExternalAddress(Object)>>primitiveFailed > ExternalAddress(ByteArray)>>integerAt:put:size:signed: > ExternalAddress(ByteArray)>>unsignedLongAt:put: > ExternalAddress(ByteArray)>>nbUInt32AtOffset:put: > [ :string :index | > | pointer | > "0 terminated" > pointer := ExternalAddress allocate: string size + 1. > self registerPointer: pointer. > LibC memCopy: string to: pointer size: string size. > pointer nbUInt8AtOffset: string size put: 0. "string terminating null char" > aPointer > nbUInt32AtOffset: (index - 1) * self systemAccessor sizeOfPointer > put: pointer value ] in OSSUnixSubprocess>>collectArgumentPointersInto: in Block: [ :string :index | ... > OrderedCollection(SequenceableCollection)>>withIndexDo: > OSSUnixSubprocess>>collectArgumentPointersInto: > OSSUnixSubprocess>>buildPrimitiveArgVArgument > OSSUnixSubprocess>>internalRun > [ self internalRun ] in OSSUnixSubprocess>>run in Block: [ self internalRun ] > BlockClosure>>ensure: > OSSUnixSubprocess>>run > OSSUnixSubprocess>>runAndWaitOnExitDo: > UndefinedObject>>DoIt > OpalCompiler>>evaluate > DoItChunk>>importFor: > [ :declaration | > requestor ifNotNil: [ requestor contents: declaration contents ]. > value := declaration importFor: requestor ] in CodeImporter>>evaluateDeclarations in Block: [ :declaration | ... > OrderedCollection>>do: > CodeImporter>>evaluateDeclarations > CodeImporter class>>evaluateFileStream: > MultiByteFileStream(FileStream)>>fileIn > FileStream class>>fileIn: > SimpleServiceEntry>>performServiceFor: > PluggableButtonMorph>>performAction: > [ :m | > (m containsPoint: evt cursorPoint) > ifTrue: [ m enabled > ifTrue: [ m performAction: evt ] ] ] in PluggableButtonMorph>>mouseUp: in Block: [ :m | ... > Array(SequenceableCollection)>>do: > PluggableButtonMorph>>mouseUp: > PluggableButtonMorph(Morph)>>handleMouseUp: > MouseButtonEvent>>sentTo: >

April 12, 2017

Re: [Pharo-dev] Please, test our 64bits builds

by Ben Coman

I guess its time for me to throw away my 32-bit Linux install and upgrade to 64-bit. I only installed it to make playing with 32-bit FFI easier. That reason should be passed now. cheers -ben On Wed, Apr 12, 2017 at 10:44 PM, Esteban Lorenzano <estebanlm(a)gmail.com> wrote: > Hello list, > > We are approaching to release and one big thing of this one is the 64bits > supports for Pharo (limited, since there is still not support for Windows, > but it will arrive, eventually ;) ) > I asked you to test a couple of months ago but now we are in better shape > to do it. > > - VM and image are getting more and more stable and crashes shouldnât > happen (but thatâs why I want you to test: to discover possible > bugs/crashes) > - I made 64bits a zeroconf citizen: http://get.pharo.org/64 > > Now, you can test it by just doing: > > curl get.pharo.org/64/60+vmLatest | bash > > (In linux or mac, remember it will not work for Windows) > > thanks! > Esteban > > >

April 12, 2017

Re: [Pharo-dev] Please, test our 64bits builds

by Alistair Grant

Hi Esteban, On Wed, Apr 12, 2017 at 06:08:56PM +0200, Esteban Lorenzano wrote: > forget to say that iceberg will not work 100% yet :) > but here, problem is because you need to install the threaded version, which of course I forget to point :P > > curl get.pharo.org/64/60+vmTLatest | bash > > this is the correct one for linux users. Thanks, I'm successfully past the Metacello load. Next problem: PrimitiveFailed: primitive #integerAt:put:size:signed: in ExternalAddress failed while executing: proc := OSSUnixSubprocess new command: 'git'; arguments: #('config' '--global' 'user.name' 'AlistairGrant'); runAndWaitOnExitDo: [ :cmd :out :err | self assert: cmd isSuccess ]. I'm going to have to learn about FFI some time... Full stack below. I should have also added I'm on Ubuntu 16.04, and this obviously all works fine in the 32bit VM / image. Cheers, Alistair ExternalAddress(Object)>>primitiveFailed: ExternalAddress(Object)>>primitiveFailed ExternalAddress(ByteArray)>>integerAt:put:size:signed: ExternalAddress(ByteArray)>>unsignedLongAt:put: ExternalAddress(ByteArray)>>nbUInt32AtOffset:put: [ :string :index | | pointer | "0 terminated" pointer := ExternalAddress allocate: string size + 1. self registerPointer: pointer. LibC memCopy: string to: pointer size: string size. pointer nbUInt8AtOffset: string size put: 0. "string terminating null char" aPointer nbUInt32AtOffset: (index - 1) * self systemAccessor sizeOfPointer put: pointer value ] in OSSUnixSubprocess>>collectArgumentPointersInto: in Block: [ :string :index | ... OrderedCollection(SequenceableCollection)>>withIndexDo: OSSUnixSubprocess>>collectArgumentPointersInto: OSSUnixSubprocess>>buildPrimitiveArgVArgument OSSUnixSubprocess>>internalRun [ self internalRun ] in OSSUnixSubprocess>>run in Block: [ self internalRun ] BlockClosure>>ensure: OSSUnixSubprocess>>run OSSUnixSubprocess>>runAndWaitOnExitDo: UndefinedObject>>DoIt OpalCompiler>>evaluate DoItChunk>>importFor: [ :declaration | requestor ifNotNil: [ requestor contents: declaration contents ]. value := declaration importFor: requestor ] in CodeImporter>>evaluateDeclarations in Block: [ :declaration | ... OrderedCollection>>do: CodeImporter>>evaluateDeclarations CodeImporter class>>evaluateFileStream: MultiByteFileStream(FileStream)>>fileIn FileStream class>>fileIn: SimpleServiceEntry>>performServiceFor: PluggableButtonMorph>>performAction: [ :m | (m containsPoint: evt cursorPoint) ifTrue: [ m enabled ifTrue: [ m performAction: evt ] ] ] in PluggableButtonMorph>>mouseUp: in Block: [ :m | ... Array(SequenceableCollection)>>do: PluggableButtonMorph>>mouseUp: PluggableButtonMorph(Morph)>>handleMouseUp: MouseButtonEvent>>sentTo:

April 12, 2017