4 ms·
It's a fork of tinyscheme with some security improvements that's been in MacOS since 2007. It's used to compile all the rules down to a bytecode (similar to eBP
by AlotOfReading 2y ago
It's a fork of tinyscheme with some security improvements that's been in MacOS since 2007. It's used to compile all the rules down to a bytecode (similar to eBPF) that's evaluated by the kernel.
I don't have specific info on the rationale, but a powerful language with a small surface area that's easy to parse was probably an attractive choice for mid-2000s security code written in C.
- walterbell 2y agoGuix also chose scheme in 2010s, https://guix.gnu.org/manual/en/html_node/G_002dExpressions.html https://guix.gnu.org/manual/en/html_node/G_002dExpressions.h... (define build-exp #~(begin (mkdir #$output) (chdir #$output) (symlink (string-append #$coreutils "/bin/ls") "list-files")))
- bdash 2y agoIt still compiles the rules down to a very basic bytecode: https://bdash.net.nz/posts/sandboxing-on-macos/#sandbox-policy-evaluation https://bdash.net.nz/posts/sandboxing-on-macos/#sandbox-poli...
- messe 2y ago> I don't have specific info on the rationale, but a powerful language with a small surface area that's easy to parse was probably an attractive choice I interviewed with the team that worked on this a few years back, and if I recall correctly one of them just liked scheme, and it was easy to embed.