Sandboxed Haskell

[benja.fallenstein@…]

 hs-plugins can dynamically compile and load Haskell code, but does not prevent plugins from using unsafePerformIO or unsafeCoerce#. I would like to be able to use hs-plugins to execute untrusted code. As far as I can see, two pieces of infrastructure are missing:

• A way to ensure that a dynamically compiled program does not use any unsafe primitives.
• A way to limit the resources (clock cycles and RAM) used by an untrusted computation.

It seems to me that the best way to achieve the first goal is to make GHC keep track during compilation of which functions are safe (do not call unsafe primitives, or, I suppose, are declared to be safe by a pragma in a trusted library). However, I know only very little about GHC internals.

One project I want to use this for would be a web server that lets users create Haskell-based web applications without having to set up their own Unix account etc. If this project is accepted, I'll build a prototype of this that can be used to test "sandboxed haskell" (no matter whether the project ends up being assigned to me or somebody else).

Interested Mentors

• ?

Interested Students

• Benja Fallenstein (benja.fallenstein@…) -- I'm not familiar with the internals of GHC at this point, but I'm willing to learn. :-) A knowledgable mentor would be good if I end up doing this project.
• Brandon Wilson (xelxebar) <[bmw.stx@…]>

[duncan]

If we can improve the proposal I think this could be very useful. The main work is the infrastructure to be able to track safety.

I think tracking memory use or cpu time of a thread would be rather harder.

[guest]

It seems to me that the best way to achieve the first goal is to make GHC keep track during compilation of which functions are safe (do not call unsafe primitives, or, I suppose, are declared to be safe by a pragma in a trusted library). However, I know only very little about GHC internals.

It would be very nice to be able to do something in the GHC API like 'set SafeCodeOnly?', but I think the details need to be worked out more.

I think tracking memory use or cpu time of a thread would be rather harder.

Tracking resource use isn't *that* hard; you can use the Unix rlimits functionality, or do a watchdog process technique (which limits time usage) like in mueval.