Browse Source

Add FAQ about sandboxing. Minor fixes.

Mike Pall 5 years ago
parent
commit
7eb96843ff
2 changed files with 33 additions and 9 deletions
  1. 1 1
      doc/extensions.html
  2. 32 8
      doc/faq.html

+ 1 - 1
doc/extensions.html

@@ -326,7 +326,7 @@ the toolchain used to compile LuaJIT:
 </tr>
 </tr>
 <tr class="odd">
 <tr class="odd">
 <td class="excplatform">Windows/x64</td>
 <td class="excplatform">Windows/x64</td>
-<td class="exccompiler">MSVC or WinSDK</td>
+<td class="exccompiler">MSVC</td>
 <td class="excinterop"><b style="color: #00a000;">Full</b></td>
 <td class="excinterop"><b style="color: #00a000;">Full</b></td>
 </tr>
 </tr>
 <tr class="even">
 <tr class="even">

+ 32 - 8
doc/faq.html

@@ -55,7 +55,7 @@ dd { margin-left: 1.5em; }
 </li></ul>
 </li></ul>
 </div>
 </div>
 <div id="main">
 <div id="main">
-<dl>
+<dl id="info">
 <dt>Q: Where can I learn more about LuaJIT and Lua?</dt>
 <dt>Q: Where can I learn more about LuaJIT and Lua?</dt>
 <dd>
 <dd>
 <ul style="padding: 0;">
 <ul style="padding: 0;">
@@ -75,7 +75,7 @@ has information about diverse topics.</li>
 </ul>
 </ul>
 </dl>
 </dl>
 
 
-<dl>
+<dl id="tech">
 <dt>Q: Where can I learn more about the compiler technology used by LuaJIT?</dt>
 <dt>Q: Where can I learn more about the compiler technology used by LuaJIT?</dt>
 <dd>
 <dd>
 I'm planning to write more documentation about the internals of LuaJIT.
 I'm planning to write more documentation about the internals of LuaJIT.
@@ -91,7 +91,7 @@ And, you know, reading the source is of course the only way to enlightenment. :-
 </dd>
 </dd>
 </dl>
 </dl>
 
 
-<dl>
+<dl id="arg">
 <dt>Q: Why do I get this error: "attempt to index global 'arg' (a nil value)"?<br>
 <dt>Q: Why do I get this error: "attempt to index global 'arg' (a nil value)"?<br>
 Q: My vararg functions fail after switching to LuaJIT!</dt>
 Q: My vararg functions fail after switching to LuaJIT!</dt>
 <dd>LuaJIT is compatible to the Lua 5.1 language standard. It doesn't
 <dd>LuaJIT is compatible to the Lua 5.1 language standard. It doesn't
@@ -101,7 +101,7 @@ functions from Lua 5.0.<br>Please convert your code to the
 vararg syntax</a>.</dd>
 vararg syntax</a>.</dd>
 </dl>
 </dl>
 
 
-<dl>
+<dl id="x87">
 <dt>Q: Why do I get this error: "bad FPU precision"?<br>
 <dt>Q: Why do I get this error: "bad FPU precision"?<br>
 <dt>Q: I get weird behavior after initializing Direct3D.<br>
 <dt>Q: I get weird behavior after initializing Direct3D.<br>
 <dt>Q: Some FPU operations crash after I load a Delphi DLL.<br>
 <dt>Q: Some FPU operations crash after I load a Delphi DLL.<br>
@@ -123,7 +123,7 @@ Please check the Delphi docs for the Set8087CW method.
 
 
 </dl>
 </dl>
 
 
-<dl>
+<dl id="ctrlc">
 <dt>Q: Sometimes Ctrl-C fails to stop my Lua program. Why?</dt>
 <dt>Q: Sometimes Ctrl-C fails to stop my Lua program. Why?</dt>
 <dd>The interrupt signal handler sets a Lua debug hook. But this is
 <dd>The interrupt signal handler sets a Lua debug hook. But this is
 currently ignored by compiled code (this will eventually be fixed). If
 currently ignored by compiled code (this will eventually be fixed). If
@@ -134,7 +134,31 @@ twice to get stop your program. That's similar to when it's stuck
 running inside a C function under the Lua interpreter.</dd>
 running inside a C function under the Lua interpreter.</dd>
 </dl>
 </dl>
 
 
-<dl>
+<dl id="sandbox">
+<dt>Q: Can Lua code be safely sandboxed?</dt>
+<dd>
+Maybe for an extremly restricted subset of Lua and if you relentlessly
+scrutinize every single interface function you offer to the untrusted code.<br>
+
+Although Lua provides some sandboxing functionality (<tt>setfenv()</tt>, hooks),
+it's very hard to get this right even for the Lua core libraries. Of course,
+you'll need to inspect any extension library, too. And there are libraries
+that are inherently unsafe, e.g. the <a href="ext_ffi.html">FFI library</a>.<br>
+
+Relatedly, <b>loading untrusted bytecode is not safe!</b> It's trivial
+to crash the Lua or LuaJIT VM with maliciously crafted bytecode. This is
+well known and there's no bytecode verification on purpose, so please
+don't report a bug about it. Check the <tt>mode</tt> parameter for the
+<tt>load*()</tt> functions to disable loading of bytecode.<br>
+
+In general, the only promising approach is to sandbox Lua code at the
+process level and not the VM level.<br>
+
+More reading material at the <a href="http://lua-users.org/wiki/SandBoxes"><span class="ext">&raquo;</span>&nbsp;Lua Wiki</a> and <a href="https://en.wikipedia.org/wiki/Sandbox_(computer_security)">Wikipedia</a>.
+</dd>
+</dl>
+
+<dl id="patches">
 <dt>Q: Why doesn't my favorite power-patch for Lua apply against LuaJIT?</dt>
 <dt>Q: Why doesn't my favorite power-patch for Lua apply against LuaJIT?</dt>
 <dd>Because it's a completely redesigned VM and has very little code
 <dd>Because it's a completely redesigned VM and has very little code
 in common with Lua anymore. Also, if the patch introduces changes to
 in common with Lua anymore. Also, if the patch introduces changes to
@@ -145,7 +169,7 @@ can use source transformations or use wrapper or proxy functions.
 The compiler will happily optimize away such indirections.</dd>
 The compiler will happily optimize away such indirections.</dd>
 </dl>
 </dl>
 
 
-<dl>
+<dl id="arch">
 <dt>Q: Lua runs everywhere. Why doesn't LuaJIT support my CPU?</dt>
 <dt>Q: Lua runs everywhere. Why doesn't LuaJIT support my CPU?</dt>
 <dd>Because it's a compiler &mdash; it needs to generate native
 <dd>Because it's a compiler &mdash; it needs to generate native
 machine code. This means the code generator must be ported to each
 machine code. This means the code generator must be ported to each
@@ -156,7 +180,7 @@ architectures. Other architectures will follow based on sufficient user
 demand and/or sponsoring.</dd>
 demand and/or sponsoring.</dd>
 </dl>
 </dl>
 
 
-<dl>
+<dl id="when">
 <dt>Q: When will feature X be added? When will the next version be released?</dt>
 <dt>Q: When will feature X be added? When will the next version be released?</dt>
 <dd>When it's ready.<br>
 <dd>When it's ready.<br>
 C'mon, it's open source &mdash; I'm doing it on my own time and you're
 C'mon, it's open source &mdash; I'm doing it on my own time and you're