5 ms·
Libc does not use your safe array. You cannot pass your safe array to read and other syscalls.
by qznc 10y ago
Libc does not use your safe array. You cannot pass your safe array to read and other syscalls.
- tedunangst 10y agoAs others have noted, one can also write a four line saferead() function.
- geofft 10y agoAnd once you have written a five line safewrite() function, a hundred-line saferecvfrom() function, a 1500-line safeioctl() function, and all of that, and you have a third-party static analysis tool to prove that you're never calling the unsafe read() or ioctl() functions except from the wrappers, what was the advantage of staying in C in the first place?
- jstimpfle 10y agoI see where you are going, but I don't get how you get from 4 to 5 to 100 to 1500?
- kazinator 10y agosafeioctl may have to contain a redundant switch (or more OOP-style dipatch across multiple functions) on the command code in order to convert the safe style arguments to each specific low level ioctl call. That sort of thing can easily explode in line count. I can see exactly what geofft is talking about.
- jstimpfle 10y agoOk - it's true that ioctl has a generic interface (hadn't remembered that). We can think of it as hundreds of functions, not just one. So wrapping ioctl "completely" is correspondingly a lot of work. However the point was of course to make a safe-land layer which contains the needed functionality. The point was never to have a function "safeioctl" in the first place.
- tedunangst 10y agoIt's not like your rust safe ioctl wrapper is going to be any less code, though.
- jdcarter 10y agoI can answer: safe read/write from a simple system call can be "easy." Safe read from the network, possible but no longer easy. Safe call to ioctl, which can literally do anything with any device driver... is a "safe" version of that even possible?
- kazinator 10y agoioctl is a marshaling mechanism that can represent a library API of almost unlimited proportions and variety. A safety wrapper basically has to target the specific functions, rather than ioctl itself. That has happened within Unix, with some library functions having originated as wrappers around ioctls.
- tedunangst 10y agoIf we're expanding the set of possible bugs to "the kernel can do anything and overwrite anything", then it doesn't matter what language you use.
- kazinator 10y agoThe advantage is that you're depending only on yourself and C. That third party static analysis tool can just be "grep". Or some mild text processing on the output of "nm" to validate that no object files (other than the allowed ones) have external refs to those symbols.
- jstimpfle 10y agoOr just disallow platform headers.
- geofft 10y agoAgain, if you're disallowing platform headers and writing tooling to make sure you're never calling libc, what's the advantage of writing in C? You have all the headaches of switching to a new language, with none of the features. And, honestly, one of the features is "vibrant community of developers." Even if Go and Rust were bad languages, which they're not, they'd still be better choices than C-with-custom-in-house-restrictions-and-libc-wrappers, simply because of the communities around them. If you're writing in Rust, someone else has already written the safe C wrappers, and if they haven't, there's a community of people who will code-review your wrappers for safety and merge them into a centrally-maintained project, which is extremely useful.
- jstimpfle 10y agoI'm not advocating use of C, just pointing out a simpler way to check dependencies. To answer your question though, the advantage of using C is certainly not the notorious bad-habits standard library. C is fun and productive exactly where there's just you and some bits and bytes to bang around. Coding in the small. Not platforms and architectures.
- kazinator 10y agoYou can easily access external symbols in C without including a header. The external refs in an object file are the accurate info about what is referenced.
- dreta 10y agoNo language you use can get around syscalls, so i have no clue as to why this is a case against C.