Allow modules to optionally import nothing at all #40110

cmcaine · 2021-03-19T16:24:09Z

See: https://discourse.julialang.org/t/even-more-bare-baremodule/56156/

A module that imports nothing at all can be used to build a sandbox. Sandboxes are useful for defining smaller teaching languages (see Racket and the HTDP2e book) and, if they can be made secure, for evaluating untrusted code in a capability programming paradigm.

This commit changes the API of libjulia:

Old:

JL_DLLEXPORT jl_value_t *jl_f_new_module(jl_sym_t *name, uint8_t std_imports)

New:

JL_DLLEXPORT jl_value_t *jl_f_new_module(jl_sym_t *name, uint8_t std_imports, uint8_t using_core)

With thanks to Simeon Schaub and Mason Protter.

Questions for triage:

Okay to change the libjulia API or would you rather I added a new function?

I came up with slightly better docs, too, but to save CI energy I haven't pushed them yet. But if anyone wants to bikeshed the docs, here they are:

In NEWS.md:

Module(:name, false, false) can be used to create a module that does not import Base or Core. ([Allow modules to optionally import nothing at all #40110])

In doc/src/manual/modules.md:

If modules that contain no imports at all are needed, they can be defined with Mod = Module(:Mod, false, false). Code can be evaluated in them with @eval or Core.eval.

See: https://discourse.julialang.org/t/even-more-bare-baremodule/56156/ A module that imports nothing at all can be used to build a sandbox. Sandboxes are useful for defining smaller teaching languages (see Racket and the HTDP2e book) and, if they can be made secure, for evaluating untrusted code in a capability programming paradigm. This commit changes the API of libjulia: Old: JL_DLLEXPORT jl_value_t *jl_f_new_module(jl_sym_t *name, uint8_t std_imports) New: JL_DLLEXPORT jl_value_t *jl_f_new_module(jl_sym_t *name, uint8_t std_imports, uint8_t using_core) Co-authored-by: Simeon Schaub <simeondavidschaub99@gmail.com>

JeffBezanson · 2021-03-19T18:42:08Z

src/module.c

@@ -36,7 +36,7 @@ JL_DLLEXPORT jl_module_t *jl_new_module(jl_sym_t *name)
    htable_new(&m->bindings, 0);
    arraylist_new(&m->usings, 0);
    JL_GC_PUSH1(&m);
-    if (jl_core_module) {
+    if (jl_core_module && using_core) {
        jl_module_using(m, jl_core_module);
    }
    // export own name, so "using Foo" makes "Foo" itself visible


We might want to omit this as well, just so you can get a truly truly empty module.

Triage seconds this.

And then I guess using_core should be renamed default_names or something like that? Maybe not important.

JeffBezanson · 2021-03-19T18:47:48Z

Here's one of probably many ways to escape the sandbox:

t(x::T) where T = T
t(1).name.module # gives you Core

simeonschaub · 2021-03-19T19:01:34Z

src/module.c

@@ -11,7 +11,7 @@
 extern "C" {
 #endif

-JL_DLLEXPORT jl_module_t *jl_new_module(jl_sym_t *name)
+JL_DLLEXPORT jl_module_t *jl_new_module_(jl_sym_t *name, uint8_t using_core)


Do we want to put this into julia.h as well?

vtjnash · 2021-03-19T19:09:32Z

Yeah, this'll never be an actual approach to making a sandbox (for example, you can also use ccall, various expressions that lower to top calls or constants, or simply call using), but not necessarily a reason to avoid this.

Also, ref #39114

JeffBezanson · 2021-03-19T21:04:03Z

If we wanted to gradually strengthen the sandbox, probably the next step is to make all identifiers that come from syntax (e.g. a.b => getproperty) lexically-scoped, i.e. lower them to __getproperty__ instead of Base.getproperty. Then you could e.g. inject a definition that disallows accessing some fields. I would kind of like to be able to do that anyway, though of course it's only one more brick in the sandbox wall.

cmcaine · 2021-03-21T13:02:09Z

Thanks for the review, everyone!

Perhaps I should have been clearer in the first post, I don't think that this feature on its own makes a sandbox, this is just part of what you'd need to do it nicely.

You can see my experiments in the discourse thread linked at the top and in https://github.com/cmcaine/Sandboxes.jl

The strategy I'm using there takes an Expr and rewrites it to be safe (or just errors). That covers most of @vtjnash's issues (I don't yet rewrite GlobalRefs, but that's possible with this approach, and I wrote code to control what literals can be created (in the discourse thread), too).

I think rewriting a.b to use a custom getproperty is a good idea too, I was looking at doing that to start with, but was able to catch everything I knew about without it, but I didn't know DataTypes have name.module! I can prototype that in Sandboxes.jl :)

cmcaine · 2021-03-27T16:40:18Z

I think it's a bit weird that we allow users to say yes to std_imports and no to default_names. It works, but I just don't think users will ever want that, so it might be confusing.

Perhaps a better interface would be to accept a symbol or enum or something as the second argument, at least on the Julia side?

function Module(name::Symbol, type::Symbol)
    if type == :module ...
    elseif type == :baremodule ...
    elseif type == :emptymodule ...
    else error()
    end
end

?

Edit: Jeff suggested passing nothing to std_imports, which also makes sense to me, I think I'll do that.

simeonschaub · 2021-04-03T09:26:40Z

Since this is a pretty internal method, I think it's fine to just have two boolean arguments. I don't really have strong opinions on how to name this option.

Acmion · 2021-06-07T23:55:41Z

I see some use cases for applying the proposed import rules to the Main module as well.

While this is not directly related to this pull request, it is something that could be considered for the future.

DilumAluthge · 2021-06-10T00:50:23Z

@simeonschaub CI is all green now. Is this good to merge?

simeonschaub · 2021-06-10T08:10:52Z

Thanks @cmcaine for the contribution! Sorry it took so long to get merged.

See: https://discourse.julialang.org/t/even-more-bare-baremodule/56156/ A module that imports nothing at all can be used to build a sandbox. Sandboxes are useful for defining smaller teaching languages (see Racket and the HTDP2e book) and, if they can be made secure, for evaluating untrusted code in a capability programming paradigm. This commit changes the API of libjulia: Old: JL_DLLEXPORT jl_value_t *jl_f_new_module(jl_sym_t *name, uint8_t std_imports) New: JL_DLLEXPORT jl_value_t *jl_f_new_module(jl_sym_t *name, uint8_t std_imports, uint8_t using_core) Co-authored-by: Simeon Schaub <simeondavidschaub99@gmail.com>

Follow up on JuliaLang#40110

oscardssmith added the triage This should be discussed on a triage call label Mar 19, 2021

JeffBezanson reviewed Mar 19, 2021

View reviewed changes

JeffBezanson approved these changes Mar 19, 2021

View reviewed changes

simeonschaub reviewed Mar 19, 2021

View reviewed changes

JeffBezanson removed the triage This should be discussed on a triage call label Mar 25, 2021

simeonschaub approved these changes Apr 3, 2021

View reviewed changes

Merge remote-tracking branch 'origin/master' into barer-baremodule

a9f6d7f

simeonschaub added the merge me PR is reviewed. Merge when all tests are passing label Jun 8, 2021

DilumAluthge closed this Jun 9, 2021

DilumAluthge reopened this Jun 9, 2021

simeonschaub added 2 commits June 9, 2021 11:13

Merge remote-tracking branch 'origin/master' into barer-baremodule

4f26a5e

Merge branch 'master' into barer-baremodule

d0ccdec

simeonschaub merged commit c22b718 into JuliaLang:master Jun 10, 2021

DilumAluthge removed the merge me PR is reviewed. Merge when all tests are passing label Jun 18, 2021

cmcaine added a commit to cmcaine/julia that referenced this pull request Sep 10, 2021

Exclude modules own name from empty modules

917c0f2

Follow up on JuliaLang#40110

cmcaine mentioned this pull request Sep 10, 2021

Allow modules to optionally import nothing at all - final bits #42154

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Allow modules to optionally import nothing at all #40110

Allow modules to optionally import nothing at all #40110

cmcaine commented Mar 19, 2021 •

edited

Loading

JeffBezanson Mar 19, 2021

JeffBezanson Mar 25, 2021

JeffBezanson Mar 25, 2021

JeffBezanson commented Mar 19, 2021

simeonschaub Mar 19, 2021

vtjnash commented Mar 19, 2021

JeffBezanson commented Mar 19, 2021

cmcaine commented Mar 21, 2021

cmcaine commented Mar 27, 2021 •

edited

Loading

simeonschaub commented Apr 3, 2021 •

edited

Loading

Acmion commented Jun 7, 2021

DilumAluthge commented Jun 10, 2021

simeonschaub commented Jun 10, 2021

Allow modules to optionally import nothing at all #40110

Allow modules to optionally import nothing at all #40110

Conversation

cmcaine commented Mar 19, 2021 • edited Loading

Questions for triage:

JeffBezanson Mar 19, 2021

Choose a reason for hiding this comment

JeffBezanson Mar 25, 2021

Choose a reason for hiding this comment

JeffBezanson Mar 25, 2021

Choose a reason for hiding this comment

JeffBezanson commented Mar 19, 2021

simeonschaub Mar 19, 2021

Choose a reason for hiding this comment

vtjnash commented Mar 19, 2021

JeffBezanson commented Mar 19, 2021

cmcaine commented Mar 21, 2021

cmcaine commented Mar 27, 2021 • edited Loading

simeonschaub commented Apr 3, 2021 • edited Loading

Acmion commented Jun 7, 2021

DilumAluthge commented Jun 10, 2021

simeonschaub commented Jun 10, 2021

cmcaine commented Mar 19, 2021 •

edited

Loading

cmcaine commented Mar 27, 2021 •

edited

Loading

simeonschaub commented Apr 3, 2021 •

edited

Loading