[CM] sandboxing

[bil at ccrma.Stanford.EDU]

Interesting question.  My first thought is that you could undefine 
procedure-source,
object->let, funclet, object->string with :readable, rootlet, outlet (in 
the untrusted
environment, like sandbox in stuff.scm), but the list seems to keep 
getting longer, and
blocking format with ~W seems to require wrapping format.  You could 
wrap the trusted
function in a c-object, then call it with (obj . args) which applies the 
arguments to
the wrapped function.  The c-object could hide everything from normal 
intrusions from
scheme.  Or I think I could add an opaque (or "private"?) flag so that 
these kinds of
introspection would be blocked on functions. This would affect funclet, 
object->let,
object->string, format, etc.  But all of these are vulnerable to 
"probes" (like
probe-eval in stuff.scm but maybe more sinister), so the wrapper would 
have to scan
the args and refuse to call the function if it finds an openlet.  Now 
I'm worrying that
a closed let could wait until it is ingested by a function, then open 
itself, grab
whatever it wants, then close itself so no one is the wiser. We'd have 
to block
curlet, outlet, owlet, and rootlet I think.  But lets are referenced all 
the time,
and I don't want to slow down normal scheme code checking opaque bits on 
them.  And
I feel like I'm missing something. How secure does the trusted call need 
to be?