3 ms·

It would be very interesting to read about how S-expressions became the language of choice for macOS's sandboxing, somehow sandwiched between the XML and JSON t

by weikju 2y ago

It would be very interesting to read about how S-expressions became the language of choice for macOS's sandboxing, somehow sandwiched between the XML and JSON trends (e.g. plists were/are still? XML)

dartos 2y ago
To take a stab in the dark. JSON and xml are both data representation formats, but the code snippets in the article seem more like a declarative language. You could make a declarative language using JSON semantics, but maybe they wanted something more bespoke. it’s also super duper easy to write an s-expression parser
- bdash 2y ago
  The code snippets are purely declarative because they are reconstructed from the simple bytecode that the macOS sandbox library generates after evaluating the Scheme code. At that point any abstractions present in the source code are long gone and only predicates and actions remain. If you look at typical SBPL source code you'll see it tends to contain a mix of straightforward, declarative `(allow …)` policies and custom functions/macros used to simplify repeated patterns. See https://github.com/WebKit/WebKit/blob/11b5279aec6113c661dac368e2fc015fbc598f9c/Source/WebKit/Shared/Sandbox/iOS/common.sb https://github.com/WebKit/WebKit/blob/11b5279aec6113c661dac3..., for example.
AlotOfReading 2y ago
It's a fork of tinyscheme with some security improvements that's been in MacOS since 2007. It's used to compile all the rules down to a bytecode (similar to eBPF) that's evaluated by the kernel. I don't have specific info on the rationale, but a powerful language with a small surface area that's easy to parse was probably an attractive choice for mid-2000s security code written in C.
- walterbell 2y ago
  Guix also chose scheme in 2010s, https://guix.gnu.org/manual/en/html_node/G_002dExpressions.html https://guix.gnu.org/manual/en/html_node/G_002dExpressions.h... (define build-exp #~(begin (mkdir #$output) (chdir #$output) (symlink (string-append #$coreutils "/bin/ls") "list-files")))
- bdash 2y ago
  It still compiles the rules down to a very basic bytecode: https://bdash.net.nz/posts/sandboxing-on-macos/#sandbox-policy-evaluation https://bdash.net.nz/posts/sandboxing-on-macos/#sandbox-poli...
- messe 2y ago
  > I don't have specific info on the rationale, but a powerful language with a small surface area that's easy to parse was probably an attractive choice I interviewed with the team that worked on this a few years back, and if I recall correctly one of them just liked scheme, and it was easy to embed.
nxobject 2y ago
Funfact of historical interest only: in NeXTSTEP/OPENSTEP, plists had a more JSON-type syntax, although of course it predates JS.
- saagarjha 2y ago
  Relevant username? Anyway these are still used in e.g. Xcode projects
  - nxobject 2y ago
    Yes! I was hoping someone would notice eventually, congratulations ;) (That's cool, I always thought they'd junked that when they got rid of Project Builder...)
weikju 2y ago
Thanks for all the hypotheses and anecdotes! In either case I'm always a bit pleasantly tickled to know there's some Lisp lurking in macOS quietly doing its job.

by weikju 2y ago

It would be very interesting to read about how S-expressions became the language of choice for macOS's sandboxing, somehow sandwiched between the XML and JSON trends (e.g. plists were/are still? XML)

dartos 2y ago

To take a stab in the dark. JSON and xml are both data representation formats, but the code snippets in the article seem more like a declarative language. You could make a declarative language using JSON semantics, but maybe they wanted something more bespoke. it’s also super duper easy to write an s-expression parser

bdash 2y ago
The code snippets are purely declarative because they are reconstructed from the simple bytecode that the macOS sandbox library generates after evaluating the Scheme code. At that point any abstractions present in the source code are long gone and only predicates and actions remain. If you look at typical SBPL source code you'll see it tends to contain a mix of straightforward, declarative `(allow …)` policies and custom functions/macros used to simplify repeated patterns. See https://github.com/WebKit/WebKit/blob/11b5279aec6113c661dac368e2fc015fbc598f9c/Source/WebKit/Shared/Sandbox/iOS/common.sb https://github.com/WebKit/WebKit/blob/11b5279aec6113c661dac3..., for example.

AlotOfReading 2y ago

It's a fork of tinyscheme with some security improvements that's been in MacOS since 2007. It's used to compile all the rules down to a bytecode (similar to eBPF) that's evaluated by the kernel. I don't have specific info on the rationale, but a powerful language with a small surface area that's easy to parse was probably an attractive choice for mid-2000s security code written in C.

walterbell 2y ago
Guix also chose scheme in 2010s, https://guix.gnu.org/manual/en/html_node/G_002dExpressions.html https://guix.gnu.org/manual/en/html_node/G_002dExpressions.h... (define build-exp #~(begin (mkdir #$output) (chdir #$output) (symlink (string-append #$coreutils "/bin/ls") "list-files")))
bdash 2y ago
It still compiles the rules down to a very basic bytecode: https://bdash.net.nz/posts/sandboxing-on-macos/#sandbox-policy-evaluation https://bdash.net.nz/posts/sandboxing-on-macos/#sandbox-poli...
messe 2y ago
> I don't have specific info on the rationale, but a powerful language with a small surface area that's easy to parse was probably an attractive choice I interviewed with the team that worked on this a few years back, and if I recall correctly one of them just liked scheme, and it was easy to embed.

nxobject 2y ago

Funfact of historical interest only: in NeXTSTEP/OPENSTEP, plists had a more JSON-type syntax, although of course it predates JS.

saagarjha 2y ago
Relevant username? Anyway these are still used in e.g. Xcode projects
- nxobject 2y ago
  Yes! I was hoping someone would notice eventually, congratulations ;) (That's cool, I always thought they'd junked that when they got rid of Project Builder...)

weikju 2y ago

Thanks for all the hypotheses and anecdotes! In either case I'm always a bit pleasantly tickled to know there's some Lisp lurking in macOS quietly doing its job.