From c318246acac6ffd5b5b3fb77e5672a00f29984d5 Mon Sep 17 00:00:00 2001 From: laxla <127752744+LaylaMeower@users.noreply.github.com> Date: Sun, 11 Jun 2023 19:57:35 +0300 Subject: [PATCH 1/8] Proposed Permissions API --- .../proposals/permissions-api/README.md | 97 ++++++++++++++++++ .../permissions-api/soidum_unsafe.png | Bin 0 -> 12427 bytes 2 files changed, 97 insertions(+) create mode 100644 docs/public-identity-infra/proposals/permissions-api/README.md create mode 100644 docs/public-identity-infra/proposals/permissions-api/soidum_unsafe.png diff --git a/docs/public-identity-infra/proposals/permissions-api/README.md b/docs/public-identity-infra/proposals/permissions-api/README.md new file mode 100644 index 0000000..70cab81 --- /dev/null +++ b/docs/public-identity-infra/proposals/permissions-api/README.md @@ -0,0 +1,97 @@ +> ***Note:** this is a draft.* +# Permissions API +This document proposes locking dangerous packages and classes, and allowing the trust root to give mods permissions to access locked classes. + +### Proposal Contributors +- [Laxla](https://github.com/LaylaMeower) + +### Proposal Origins +- [This discussion](https://discord.com/channels/1115852272245686334/1117392205787693107/1117454247529812115) in the MMPA discord, in `#wg-public` + +## Goals +- Preventing mods from accessing dangerous packages +- Allowing all current possible mod functionality to stay possible + +## Non-Goals +- Allowing trust authoroties to monopolize mod features +- Defining what will happen to an authority when breaking the trust laws, nor defining said trust laws + +## Proposal +While signing is useful for checking mods weren't modified or infected, +it has lots more potential—as we can check for much more than simply "load" or "don't load". + +We propose to add a permissions API that allows mods to use forbidden packages and classes. + +> ***Note:** The following is an example and is not the actual syntax that'll be used.* + +Currently, the trust authority simply sends a "load" and "don't load" response: +```json +{ + "mycoolmod": true, + "fabricapi": true, + "meowmeow2000": false +} +``` +We propose changing it to a permission object: +```json5 +{ + "mycoolmod": { + "valid": true, + "reflection": true, + "unsafe": false, + "natives": false + // etc + }, + "fabricapi": { + "valid": true, + "reflection": false, + // etc + }, + "meowmeow2000": { + "valid": false + } + // etc +} +``` + +This proposal improves the security of using things such as classloading, reflection, unsafe blocks, native code, etc., but doesn't prevent us from using them completely. + +In the case of failed communication with the trust authority, we propose to show a big red scary warning pop up, +with the classic "Here be dragons!" warning and "I know what I'm doing!" button. + +Examples of dangerous packages ([Source](https://docs.google.com/document/d/1EpynBXdKLD69F0F0nk-Sph3FXd18IMs8PhXENB7dl6g/edit#heading=h.b4y2p3mjmgab); Credit to the MoCKoGE community, especially [NerjalNosk](https://github.com/NerjalNosk)): +* `java.io` - Direct access to the file system is dangerous. +* `java.nio` - same as above. +* `sun.nio` - Another file I/O alternative +* `java.lang.ClassLoader` - Allows restriction bypass +* `jdk.internal` - Provides access to the JVM internal aspects (e.g., a variation of ASM) +* `sun.misc.Unsafe` - Allows bypassing the restrictions set here. +* `java.reflect` - allows to modify code. +* `java.lang.reflect` - core part of the above package. +* `java.lang.Package` - ensues reflection exposition. +* `kotlin.reflect.full` - A branch of the kotlin reflection library (`kotlin.reflect`) that also allows modification +* `sun.reflect` - regular reflection alternative +* `java.lang.runtime` - another reflection alternative +* `java.lang.invoke` - yet another reflection alternative +* `java.lang.instrument` - Agents and bytecode injection +* `java.lang.constant` - not really sensible, but only really useful for Java internals, and using it shouldn’t be considered +* `java.lang.Compiler` - runtime compiler accessor +* `java.lang.Console` - Provides access to many JVM-controlling functions +* `java.lang.System` - seems fairly explicit as for how that can be sensible +* `java.lang.LiveStackFrame` - JVM bug, intended to be package private. +* `java.lang.Runtime` - includes System-related methods. Only accessible ones should be provided via a façade +* `java.lang.Shutdown` - Can force-stop process (alternative to `System.exit()`) +* `java.lang.Terminator` - yet another alternative to `System.exit()` +* `java.lang.StackWalker` - More of a safety issue, can be exploited to know more of the already run code. +* `java.rmi` - Remote Method Invocation can cause some fairly serious security issues when it comes to multi-device connections +* `javax.rmi` - Alternative for the above +* `sun.rmi` - Yet another RMI alternative +* `org.objectweb.asm` - ASM can be used to modify bytecode on runtime. Yes, it's another reflection alternative. And it's VERY powerful. +* `org.spongepowered.asm` - Yes indeed, we're suggesting to restrict the mixin library. It can be used to modify other mod's behaviors. + +## Alternatives +- _Simply have "loader plugins" that execute without blocking access to special classes._ + Popular mods such as sodium use lots of unsafe code, + ![Discord message from IMS](soidum_unsafe.png) + and a big warning window every time you open Minecraft with sodium can be very irritating. +- *Don't block dangerous code at all.* But we're talking security, and that's unsecure. \ No newline at end of file diff --git a/docs/public-identity-infra/proposals/permissions-api/soidum_unsafe.png b/docs/public-identity-infra/proposals/permissions-api/soidum_unsafe.png new file mode 100644 index 0000000000000000000000000000000000000000..43ae00d2052da0bfb706fb9b4b17b0c861206c1a GIT binary patch literal 12427 zcmdVB6j@wOB%P+Zay+$DH%ik22DF2&uYNC^-q6e~`E5K`QN z1cG1s{oNP${sGU6XRTSY&djSbXMbj&&)$3Hla7`;F#$aR78VxqtCuQzSXd8(@5kzR zIQQpo(y#fku!QwqsVKe$TkPlff~nLq4}uO4R)P+eH&?zbd?U_1dOSW)>m)1{E+Ung z?Mcmw|CEglAOF>3&KG!Wg)bg(>ZmD6<$rvE_eMfWnmpU>%wP6u<%D|5qcTZJr6+_J#`^EjRv4$Hc&zy3{)i~0APfHAU4h5{*Nh^1 zzM&XoY`K=QWs_-{6Z&4^KKT(sDwtEFa-G-(NH>k>uVZ@G3?Vs_;1hNldRhr@72D`w z{OEceJ)d#B4rfXWUl&Q!{qOnns7HCP{ZDD53_P8Z4|c+{&T25=>%gT(<3w#+7-DB> z0I+co6Mm}|GvCErnn=wWFhZiDzNcb_@#*yYjwjf{H(7kbT8Wh3*LhDjFqiazEacyE zqNYlWBP<8C!s}d)ZOrJNvy@(*LIO1Q-6Xwacx}!L0sS<;vT~9;J=h3JwSF#)-ME2< zC~!dkoRQV8sgA(tSS@V}1Hmfo+Xr|3>b#>0 z2w>_4mAk1k>?-}I_mv-d+5N=5SsQ46dd0guTZ_kRJvZ&!n&WCc+Rb3N$qj8F_#Z|E zuOjotE1CiHEYXei(Vts69&=JeBl|2K=^nJ;3|tlIrcs55%iOpD0ttP7EcAkA!QWks zqyG#&d3xoyrZO$K^eUk@WTB=v+`aMW)spQJuR;vNAj#T(V{zNNz=xr^4-7Y*wRqOp zgYK+SwGij-+vCY?>%MqCArFL_w?CbqgoHXXhg5J~Z)m%ew$Nxh8lho+Uztl6#{36% z+WL7~#4Z!x#lo*!1eScwYhDN34!CTsgpe$H(?zDskPKYT2cVV$9))1^Y2q^ufMg-Q zD5YHsTG?KM^$=j1kn~yhNBCX6s6T0QsK%CY>Mcy6N&S#5Zrb@+1!Rj|3v} zBs96MCEEOuD*jw9)M=~lcCg15rA*0vC)yyZqIFGVtrlJ=6BXn z86r6N42H<}X0*H%kRvTWL1rc)NY@EA1|Unz;>+@})j54NZqG&*5J2Yp`VY!*-8};1 z(jXn;shf^M%4;3w#$0K?p<8B7*SjM=&|ofggt-2SZ*d5K3=LW+Dkaai`p)6_T|fNV z^OMCC{o-ztBx9S_Koiq`*zvvF_dpc8G5d_~zFbD|yaIx7Y^4SZ4^hPikR<-IF_o(W zU?tPtdB|Rbku>q(Wk!JZ(`%(Zk0w90WsQ7FU z`YJO+D#Y7B%I1rf74Rj21%t5azG+NyB*}{yCy7G1STNrn9||E9?Rn*8O=8Z+K}cOyW|tDRBH8y8 zhG$!`kJSS@zvje_U_Wc~y?HF({`P@cZT}|hVd#YfMq^twumM8M@}m|C`w$7x&j|Hg zu%Bn4eQ%JskuQ%>f1o~Y>9l%S58L#sY7QySMC~qgF)&l#JzSq0x7kCHfa{ylQt`9{ z)CHhK8<*Q1%2Nh=)6^Q8U}dfVE67^)YfQ6?E<*~Y1ypc=16W>y-=Je35PNu+&|0&TQX1vKj?k6HSb5; z;l+X-ZP5FARd-7lgYBXTZCa=lcH4U6J+6Ym4`Y?>lC4L1*0&BkhyCRdBq)wxOvh4ADF!Zt?bP$Z`5N1AH=It9ym1=9{W_%Vt$QHOLw$vIk5Kx-9 zh6wk>)DD3ITY;qAr{-}i z@q4s#I*P=0jGHHbmu+YBtMkJS?$OJ8MkyHJC9J)tKlo0e44VZCbhuySZw@^)%B5hd z(eA9_lhWcju4{|H3vsGGNvplr>)2u(*R*$Y&G1uh@?iRt^s2~K*A#=x7?HS?){5bx znH$_B!@J(8)K)(B1D*|mvl^~zp2y2webe1?S4mcgKg|X`Cr3%p=g~ha_9dZ0iW!{R zl@jQ}M?l7XPe}P1wwIC3UON&>_zD4~ znmeAqJVN+QS}Y>+Sn(kGzbWv0o&lj898OGQQR=HUui015jiax2TUJlL7Po~Ik;5&^ z`XvLgfPqd!C79f>^v|Fx@7ilcQC zh3oZ5iH|w!zK3Rmt#d-FyL=$`o(4*m(X6B-{>^s%%uwJbToKQ|$i$BJGHs0a;Ue*f zZC6-CKD>OU>z2>5i9Gmw7H8hzpY-Wii<;}MtP_pX?S+~DDEDPvLEL1?4Xam35Owa2 z_in`iy+1+{T$rVbiR3|?D`j;X^sGfh?CC-9hcj{CT(aI`+Vh#3yZyjmWb633dt8438 zZWcFg3qU$;QAgA?C|;%Sp6`jJT}D`v#^q0y z-oFi}@pLP?UG%o;=O>0&F}hCJTp=~oznT$zfCeC@h)^o>?50KDy}vx@l}ONPpJNkZ>&les>o_mn@0bs-izY^ zzLDlART@55M!E28!5N$R9pyu+@8_-{u=nItM!7{==sMSVl)+40Q%HJQBKywiW(w6;hB zb+AOA`s##pzJWtVQKNI$p`rrDa$aSF&5mh94JkXBleQ?qfTE$J!(W7 za-L}MbGH^5P-_)Pv6`gqi;L)iw};i{xjyO)!L|%KmbfLi`qel=2Zwh=)C%SFs+SHQ z1^ba5(Acgixj(P*^IyG5_WayB%$)d0{atEpIam)dsLGOfV$pJW)7~GV9z5?__2-kW zQ#Fyif##6=PRn>5=Z;Jyyf!ZYyXQ_HBu@1v`CU3{_m3}c@X68$_-sxHA=%?xYJo1K z2@XskJQt5fF^Jf@i|h85k7j)TY5=4354u#ioudZE!+%;grpzNL1?9{sKk3`nR9#kA zBh|#IWUYrioR+=kD`dqLCpWjK3y1rGdUkZG+Q5iBGA)e&=a{C~wFxzHaGi%qxl#fN zxn27Kp4PzD2Xa@5jWHJLdvOBQEtnz+o@)U5cgOcq10kPORO4PLO)|vfzgnKsEQ+w4 z^9g#=<%SdcP}W_Vi}}2SAJT=|#|Vq#(j?igx~MWAbQxcR3!ouQ5X*zy-n>K0$NuQS z)`4=2ATJR-f&Ouz&!dprWBS{x75mkFz88Z=NA719fp;#P!jOiL+c$y1w~ys3_y=SL z7TS_MX+a*O2r~yFtpV4*$Pa|NlfD25G*Knmh`C3lz1&X^L9=s#K?{ak9Gaz;dTt(o z-Tu-5>bB1f2RYU1(Ll(%*~PL~7`ab_NtKbH-=4L@KcvK(Gf_pfg*5T{&HlY_X(&IP zLfuW$VH|_}4dikOWWoBj)&0}Pf(9_cw3_hr0zui?0|TX5fWgRs2tP%s7kWE>A9$ma zZ*NcODVr{DsYwgGKDC2r!>AG5_p-!miU-lUk?<`^=gf^J;(;2Mkh-|3RIzIKs~pY94u{L!`G z$rG__PjyX5l1<`NLh}H|c_G(=3OQ&{>5otsX&UkgC%0EtAJbov>Oygtp@*Mo-mbjM z&CCGIDEiHU6G_aY%BdRFCi~`rw#>YB)vWY~ zdDBKz|9GCtGhK^kyT^WBf57AL4N9v3zKJni21K=7Nh69)}t9yU0kAjnWsQ_ zj{6(3y~ndOstsv|s4R_XKohc6%zgnrW?lShv;3AcK1PjngsTaDl7z@CI}Uvhq^qImFl5tBDR#lBZiNsdEFes z;urvOzZ+2V*=pjk%&{;1H`>C|)GZe8{rputN+8jx_WILwG_ zjQ)`|fSxS20ae|W!W;*Sd#}mGjRwNt`v(tBkQo{uCyWhpIO(} zf9QUR^;G}jCMt%9ljsU^TtqMV7|$NYujlTGmW^x z>b_?H3WiXiwTwHj154r|?9(4}wqZ}-vln7ogKBJ&06bG?YU{U^o0B`1cVzpwQ|z}U zcle5Nwnbj!5@sVW`?&|>j%JGWF&o47fj$QS_J?;ZcSyefyd{)=VJ}3e&mOy*{s$I3 z_g5>PVBA)RNx2n293A#PI~E?@gymY510aa&Xdc{>=ox%R7%a-o#%Corrgqpj5Mh_H zzmnLws>!q1QXCtLlH(zSg@#QCyj-XwvDPBV_*1}?d$kEd{kXd!x>UI01HYk7Sj&N- zf^{Xj15aqXfB2BV;hk7Z?eU(*(N)9$n-lB5E$3-rBWciXL6gK2Od z-A7{6WB>n?B8-;8{9Psp^xh}$?g^xZo6A*WHmY9-UfMo$=~rbNf#b$q`Sw*R z+~Ho2D9DDd2;GqVNR!F8LsI{B##ak|DLe*+t{SRIuZ)f9Eb;vwkdcZ$GW_!(@Rzi3&U*QmQR0J&`o=@9J&6(vpJvW0qsrHU2#4@qd;G zD_)X)9V*}nMciRcUhnz|LBsjM5W|6yX8D5*SI`Y zML|?wTJ$g*XGwC*%+0ay`5+B#xelmk*1jH#g5Q~i3h|C3z5==3Mfpg%fi^niEw~H4 zy{~!Fq7Hs0f37Z@Z#Ba2tBk&X!$h&?8ui>bMd^$L@&bELu0C8Cu2cQbr(~Y8LY$*s zJnZfc)Wh$>-5gGt=U_?ML}=;a)NDRQ>Omj8<%;0o=qI&jm}TpOlNu{B2&}mZ5GX6V zvp*+K|D$(Q*GYM{ zKKLsiY~Ogcwn6wz1dvMksbMQ;h%alFBzE5>QfDT}KEb(swA|1Yv@d5R6UrdfhO#iPo;p|tj zdLhWPR@YJkKkWY*xr1WwFigisMttCH#1GSCea`Ee_x*AkI-QpR;+hyHl2g@192Uxb zJVlEkTS{kmsQ#n~pdo<9N2=;4mpV;^Uv=c+pY=KxQL*j|o|ix;F>mr09Gc#G)8K;p0Rd zV?1+DzXQvZmc=!}uV^8Y{j2)5dO@+er~1aB9oh+heEF0jh+I)lLS|~rQ{y_pnp`>Qcjuh&g znIw&KdY)}7*h$agLJd>lerTUcSzB;3(kec$!7PaWoa}b_gB5Cu>a4$~@_ml?j`Wg) zrMcZW7A)D_QsbWLTmx&_+Cs!|Nsk-dWQ25YU^sq!&&boioFkV)@v;-~l?M)6 z>Pl{&B>k3kquazm$$fsPZoNhF#(&-5_x>ycA5Ky)3f>IG%rXhLJA=F~6cqX{?Hk?Y zMd(VAq=jCC7Vj@`SSJ_Aev!1i^z~6nY{ebE<-Hzzs=|A8ZfL@&Mp_9gyLq?zNCPPi zhr%3K?)+?;$1P^8>CSK7xtlkddgDF4+xjt2fkp;bYnh|(#Oh}i=oi#ojEh?-=O<6( z2TQw+XXLZ4gl-ILm!l~*6$W!}1`Ia$mR$=Cx_hv%4;`zC5cMA_1mnX7Uk06(?oF#F zQ1d5*=BlTeTIT&z?Cu>Lyh4HHPDwYztPy)-dOca^bD-?I_MpAfQq*yRUSZkRyj+w0 z`6bfxU4)l(Qy5RdU+jBx!Uc|3snJR*oVNjH{>u;kus5Vl5&7Ll1 ziiBY*WO#yb)bU^els(hkk^f@jus_^9=e~RJ5R{@nTnDYWj6E>ZPSRZhP)1j#oyOsl zmBrwxZqFvfa%4S9ZeC$%5AIIe7XUQ63X%9#_x?_Y^_FP(5?v0|PF#dsbNF9R^;lhM z?AH}04WNjE9u4|N6u5cfJ)Z@0*cWq<2%3My_~|EaSVebwGndU%#Oo)^xN(V?>2`#q z8%Tvz$&Nxe*bmC^dRXuU%rVu*ETJ5OhvnNE$nFhx`E@a$s7=%2yDmB@+xlk+BbJbR zWoL(Rstocc`JM~y&iLbCuUHW6*0vgTsikdeza9;)_jYZvhiNmNpcSXy!dB%>+njP{ zM6$l%>l>AMlF&*|Ian%_AwXR{5-OOPH$@S7J;>KfV_JRtr*>vqpY+ULE!N(;o_n2= zFcK0ftw7O$)q{vfd``(59pur5KUhbX=`I)oKOfW+Xh^pVmW5n#`rl0{9G#80P57|+XwxS?Y8+&r8X!~cUg05Kj-j|xa(kXQ z)isIowD@2!#vRI`N>7paxG~m+4ZLZ6x+T|Ql56OEX%l%uotnht^lqAL{fh*1B|N{} zp+CpyvW5OrB5l{uYp~m?FKS|ew{uqAgsIf|D%2rw(y?AjOw*4ZbF=PqW5BFs`hC;9 z5Biz%!zo6Ny_=D#gQ!v3C1?WJtIJy}()w4>N1ghaYnTX2xi+R6PFtEGHO@5oDRoG& z`_WzgV{hlnz-(%S-|=g>qQlt-@1RbJAm-aBv=`4N0l^4d-Rbz%n=I#LlAX#Bdf@Cr znfpv>u;20<7MWjTI~m^AKiGA=mBgg4r^jIT&a}hDd@!TA@^lkDv3FbX!8-}$5qSK% z^(kx7YDWj|DYe(39Mr8!-pz+p)&Exf=?Alq;k$+yj4@$PjhwoXcT82|BYRMtn|+^* zoTzg$Q3$YLSpARz_GH&41maG_WY9I`aPwLL{Uc>hW0;{YKnqdg_u+I?+;jX@5M<8j zM)L8j-0she8f&O+-M-^~^3-&oT1K9?oouf04n?r-9%=b2O!XOw@^o*kgMN~2uBE6Q z#C0g9-SFy^G3W$nP{ZL0^x|B>lM{Q zR7st&4o3@?DtF#pPan|a2?*qIU1tv8W<=`mPU2HljK3N4CmdszNg0~m6fp%=)keg7 z4l8$913Np?p_iii!J3$aET`H%3#}t_18C-$J#e!W@|YkgD1UhTGiR=H-eA>@Q^gtF zOzbtLYu5QmjjigcnjWPfr)R7rISoah8@?hCVa=hRS}m@rEOO1Q~?CrqmvV27c1ti=cveDcNeBS?9X zcd>>iA4h9vu z!tG-WZZ9L?D_i7GOY)4?v$}rj59AwUUlHv-w5d4u+LnK<87IsP`Xh#G;2QYx6q?`! z`|8|Yf;$WrB_#$B-;~wIRUT)Qhxk9>IY<};nb#KqbLeY}1nt0ad4xwYtxeUqqa5DuK1F$b|dzq)s#nyWXaR6G!(^vH9ul?krJ??;EFislsT1pb=^^| zF!l+aKpS#x9=6_qU%(4o?h5z}SFS_f8`Gzmh~gp8@_1&Ci8-O1`@Rfm_3-9FmwL0o zocNDvF^&YmJOQZ6c9JDrZc{|+GpkeS2X2LmMK1m%AAV7^Ym{{n^;@RAxdFwr+ibb3 zTj5AMsI46{Q%i`vtCPasQey6H+hqM~G`@o9Su|}Vd<$R0;HL4$-rhFvUr{GPQfyWe z+%+nj8Hih$X1~fOv}E;sFm;C8*LBRva1gxBIcd+&_--Xkz}}eAo}MiMVwi9uVZt-{ zQRh8x=l#1Q|L5wBwakoDr_cE5+)B#XAU}|MvBKwPchvfKb19zRx=X#eKB#h>N8c4-`HE{)2zk9>|WiZ9(+7$UnH*Is@l4v#X@ zn2IQ_pPIJXH2#VZpIUH$B&mIYoxYf#zpOYEd#nhXs!lYe$>~V=m@~EEpolnCK{3Wx zifl-7Tn}r9=xH|9ooozg!7S{{LlWt?vH$$B!vbpsxe0}Dp)I5>WMsIYM|SqMyLqI5 z!_pO69f0#4x$)!hMOXTuU|4T(#J-c`;N7JMh)szXF4II5WPl)gerEu9#mG}?Q}Cx5&YUqSHu0+nt|Z{Nm! ztngczL96~n!E`D7srcu)){!WyGYc0Ixwqo;AB?y5XBV+m3y#`sg+*szZ|_Tr$Thz; zesJOspls7hbyt0KmhSvS>QBIxl<@ltaRjL4I`gLBtD*+73zQk0Ozxa4Pgu^hft$YYy4`0^dheoCma9&D38ARR4^ZxnY z&_sKnK%Qsv{y~J3w(t9nTBXd!#$%N3Y2@g)@NnwM^NfLcabN>^@UKKdw|QqekGZNB z^{tPFCH^2c6DY2(-MlREqpYIq>3a-g=(DVs}-xmA9CwOu-v6c@YLM-%GtL=-X(IR4x8v@3a0 zLathjJ=(a#TWyc>c6oV7QJMXLM0mx05(>-9yvmQkwT>50!SHIEFL6=s7>&ZxZi zPv6e`Z59vz*78!UZv@OMkWiRs?=M8wRmsRHDx7EWRI8kJyj&M9H&^CZ@ozs(=_v6Z zT_maoO18*B%jil)NB^Wik}Swt)T5G7xpaLb^vBl{lmr3(qnN54WXpZ^^ghJhKmAD? zna3<&lzscRNoZtRN4sJnpnQ^2|2{{Fu+(2*X>^mGYWtD_iEc5Z2)Etkx6=61pnEC1 z*fqT~?sVbUpukTm7dw&@UXc?{=mv(Ym zhft5-_6G|D3QKi7S0c?#OR5j!$5oH#r$O-Oz>g%p-})Ukkul3i`m>=q-Zf5BnmH3a zpIsy^<%*vxJI}Y%Z-dIJD6B&<3IuXDQjX;E**N%((+V=LnbXm~PsGK}8e62RG%?#U z_5y7dLf7EnQRSaO6&n}Wwk(8BF$&lO;^ee9fpnL zu0U(hi03ZN`>j&{W>AX+Vvr=u!gv;cU%Jnb*2U%&GaY%4+EFWYu;z!5-w;sh)Ev}H z&UQEc;THt!rR;qhV;YR~cC72#!qv@QDP}@Yw%Z!f?t+?FZ1+H(t#>7>pCVY?8Rc;h zXP(KlTk!;>+>}n{;cHBex^2r07qCv9`Z22F+{7W@M*a8FLcMI!*fF^Z`1l$i_7U%I zVcT?Cai6VvXmtr~*;j0tpD!~eBRVMUYcxLZ*ArnoGJU34jfZH~yo7CpiBAQ`5ZVcX zmF-ypOuraPp9PMZ|DJys6ilUD$lz`V2`|DINSONcM${*hzL{=?McOoP=R#jgG7D7% z%bCKtH1KZrzWi<<0k;t1h-F_s`xIpbMg58Uy??pF z**5PIJ`8#zse~A8qYR=SsGM}OcZ-dzt+#^Z&sPX!^ho?}Qnl%H(ff*;vMOD!o};Dm zgqHi@ggRdRUhz!mh{#*GbmeJIjm&7KLwoNf6g-P$p;<93*x5oB(WUfoTR$WG97GA_)_BN3D7rM?!NeH$~9c`Y*I>Y|( z*Mls&7*jD~d%kq`L3UQcF0;>Fix0Ld`NJlH=saYdb(_Y>uo;XB#C}peXw1|;b&rkY zzzU)dH(K~8_MjgJ0xi-cc9>v*e$;k04M@*e0lP1z*sCE5bW0I(7rM>!EdJalBP#~b z449_CHJ}=j+IcAk9iBG4%`EXqxZ0%%j_Towv2q zK}W^qFb||n;yp)wbJx8T6P=!;{&dvw>OSTX5svSgX35+CIF+^7vJg(r|0S=qZUh&91FFsisFutjYA}Pl|twO;d^~?&vc1vdObUN`?+%v#hf%X5fG8L z6$VSr|5D6Ro}W7#S#!z26qw`^^EW*G|HetcxS6Xh=Bm+c<%IvN#PX zgXZe<7I$}?1UmI9M)X9baxz2}YY9FL(XJ%KX*%|nIHh%K{!)KU@AOZd`I=my3rFHn zK=VKIo{_w}dAZDqP~$n1d|?(h3rTe&Gi)e;fZhYzvL$2Dh_3A&3%e52egPB)g7IaH z=m|b z*INZ2_84HzCQP?;Abkoa+x;YW10l=2-j*SNxxnb}6Gv*FHK)03lD{7l_}niRNuZB+ zX@uJR_H{346Z7CVGJ|0@u81JP0d zT{!fe8nfvg{nwHv1=~qmE?RcgK`hWio|X98VG(`MqE)&?0$R0}8JFfi(YfD2r~L9t zF-sAIv#T9oEs6W53Ft)VRC)URgf^i$PjlfmD~^jI`2ErD@)NNGan;kpS1-M@qn#|( zQ{FwcvY()5#CKC}NeUVS&z>$rN`cnxAG%cLtD@O z7LqI)>;ovvPFWfDqmBR5S5kI*2z6Vp?YOOWWSuL*?mK@@*x#9!m#4;wM3$hxRi0`G zmmgxo&}Tzu7O|A+QnBG@QvyovBn{a{tZ;VBpJf`>l@HIqEP*)u*Jb<1Oe5@>s*FJ5 z+X}QfJ7nMMkCVty&Wt+HlGpH3YC&jI(FlVq}G^4T2P4B>z!$f$5*~8qZeHP}iQs_zpHsvamFCIK9-PO^OK!t1oMYq0;V0p92#<5D z?Cn*Y9z*10v%!8&4yzb;ppFz|%I4$0fCyn8_4ExF}yA$$AkN!p>0PU3N9o*eKYc&?x!=i^Aja}{;fMM-e!t+B(x*H zp4CQaUHl6)A=;6)RKfmHK0AbSi9t_Rig1swPJez2?s6~CmNfIP#??Y^CtfqlkuCh`D0_e}@H;tpCSGsJjOK literal 0 HcmV?d00001 From f48110483231ee5f73d06de79333e86500cdac3d Mon Sep 17 00:00:00 2001 From: Laxla <127752744+LaylaMeower@users.noreply.github.com> Date: Mon, 12 Jun 2023 07:37:21 +0300 Subject: [PATCH 2/8] Improve Permissions API --- .../proposals/permissions-api/README.md | 69 +++++++++---------- 1 file changed, 32 insertions(+), 37 deletions(-) diff --git a/docs/public-identity-infra/proposals/permissions-api/README.md b/docs/public-identity-infra/proposals/permissions-api/README.md index 70cab81..a4c17a0 100644 --- a/docs/public-identity-infra/proposals/permissions-api/README.md +++ b/docs/public-identity-infra/proposals/permissions-api/README.md @@ -8,58 +8,53 @@ This document proposes locking dangerous packages and classes, and allowing the ### Proposal Origins - [This discussion](https://discord.com/channels/1115852272245686334/1117392205787693107/1117454247529812115) in the MMPA discord, in `#wg-public` +### Definitions +- **CA** - Certificate Authority + ## Goals - Preventing mods from accessing dangerous packages - Allowing all current possible mod functionality to stay possible ## Non-Goals -- Allowing trust authoroties to monopolize mod features -- Defining what will happen to an authority when breaking the trust laws, nor defining said trust laws +- Allowing CAs to monopolize mod features +- Defining what will happen to a CA when breaking the trust laws, nor defining said trust laws +- Deciding *how* jars will be signed +- Defining the process that CAs should go through before allowing permissions (that is their own thing to figure out) ## Proposal While signing is useful for checking mods weren't modified or infected, -it has lots more potential—as we can check for much more than simply "load" or "don't load". +it has lots more potential—we can send much more than simply, "hey, this is the mod!". We can tell the CA more: that this mod wants to use unsafe code, or natives, or Mixins... We propose to add a permissions API that allows mods to use forbidden packages and classes. -> ***Note:** The following is an example and is not the actual syntax that'll be used.* - -Currently, the trust authority simply sends a "load" and "don't load" response: -```json -{ - "mycoolmod": true, - "fabricapi": true, - "meowmeow2000": false -} -``` -We propose changing it to a permission object: -```json5 -{ - "mycoolmod": { - "valid": true, - "reflection": true, - "unsafe": false, - "natives": false - // etc - }, - "fabricapi": { - "valid": true, - "reflection": false, - // etc - }, - "meowmeow2000": { - "valid": false - } - // etc -} -``` - This proposal improves the security of using things such as classloading, reflection, unsafe blocks, native code, etc., but doesn't prevent us from using them completely. In the case of failed communication with the trust authority, we propose to show a big red scary warning pop up, -with the classic "Here be dragons!" warning and "I know what I'm doing!" button. +with the classic "Here be dragons!" warning and "I know what I'm doing!" button, and give mods the permission they require to work. + +### How will that work? + +When sending the mod's certificate to the CA to approve, we'll append a list of permissions the mod needs to use. The CA will read the mod data and the permissions, and tell us if the mod is secure. If it is, we'll load it. + +#### Tech Talk + +There are three ways to implement the check for forbidden code. We propose to require a modloader to implement at least two of them. +1. **Java Agent** - requires an argument to the `java` command. +2. **Custom Classloader** - implementing `ClassLoader` and delegating to the original one after some checks. There are two variations of this method: + - **Plural Classloader** - creating a new classloader per mod. + - **Singular Classloader** - creating a single custom classloader, that'll use the stack trace to see what mod has invoked what. Will require additional security measures, such as using Java 9's modules. +3. **ASM Scan** - inspecting the jar with ASM before even loading it. This is the slowest method of all, although debatably the safest. + +### But won't someone Mixin into another mod, stealing their permissions? + +We propose creating *two* Mixin permissions: +1. `mixin` - allows to Mixin Minecraft classes. +2. `mixin-elevated` - allows to Mixin other mods. + +This will improve the security of Mixins - although we check for forbidden code in the mixin package, too. -Examples of dangerous packages ([Source](https://docs.google.com/document/d/1EpynBXdKLD69F0F0nk-Sph3FXd18IMs8PhXENB7dl6g/edit#heading=h.b4y2p3mjmgab); Credit to the MoCKoGE community, especially [NerjalNosk](https://github.com/NerjalNosk)): +### Examples of dangerous packages + *[Source](https://docs.google.com/document/d/1EpynBXdKLD69F0F0nk-Sph3FXd18IMs8PhXENB7dl6g/edit#heading=h.b4y2p3mjmgab); Credit to the [MoCKoGE](https://GitHub.com/LaylaMeower/MoCKoGE) community, especially [NerjalNosk](https://github.com/NerjalNosk)* * `java.io` - Direct access to the file system is dangerous. * `java.nio` - same as above. * `sun.nio` - Another file I/O alternative From 77bda6c7da58d74d038eaff5dce8eb9be7ca33a6 Mon Sep 17 00:00:00 2001 From: Laxla <127752744+LaylaMeower@users.noreply.github.com> Date: Mon, 12 Jun 2023 07:45:35 +0300 Subject: [PATCH 3/8] Removed mention of obscure "trust authority" --- docs/public-identity-infra/proposals/permissions-api/README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/public-identity-infra/proposals/permissions-api/README.md b/docs/public-identity-infra/proposals/permissions-api/README.md index a4c17a0..ecb0201 100644 --- a/docs/public-identity-infra/proposals/permissions-api/README.md +++ b/docs/public-identity-infra/proposals/permissions-api/README.md @@ -29,7 +29,7 @@ We propose to add a permissions API that allows mods to use forbidden packages a This proposal improves the security of using things such as classloading, reflection, unsafe blocks, native code, etc., but doesn't prevent us from using them completely. -In the case of failed communication with the trust authority, we propose to show a big red scary warning pop up, +In the case of failed communication with the CA, we propose to show a big red scary warning pop up, with the classic "Here be dragons!" warning and "I know what I'm doing!" button, and give mods the permission they require to work. ### How will that work? From ea02f94596b0e0cdb39bb37851a7c1f780aba5c0 Mon Sep 17 00:00:00 2001 From: laxla <127752744+LaylaMeower@users.noreply.github.com> Date: Thu, 1 Jun 2023 03:12:28 +0300 Subject: [PATCH 4/8] Fixed typos --- .../proposals/permissions-api/README.md | 21 ++++++++++++------- 1 file changed, 13 insertions(+), 8 deletions(-) diff --git a/docs/public-identity-infra/proposals/permissions-api/README.md b/docs/public-identity-infra/proposals/permissions-api/README.md index ecb0201..0099bdd 100644 --- a/docs/public-identity-infra/proposals/permissions-api/README.md +++ b/docs/public-identity-infra/proposals/permissions-api/README.md @@ -23,27 +23,32 @@ This document proposes locking dangerous packages and classes, and allowing the ## Proposal While signing is useful for checking mods weren't modified or infected, -it has lots more potential—we can send much more than simply, "hey, this is the mod!". We can tell the CA more: that this mod wants to use unsafe code, or natives, or Mixins... +it has lots more potential—we can send much more than simply, "hey, this is the mod!". +We can tell the CA more, for example, that this mod wants to use unsafe code, or natives, or Mixins... We propose to add a permissions API that allows mods to use forbidden packages and classes. -This proposal improves the security of using things such as classloading, reflection, unsafe blocks, native code, etc., but doesn't prevent us from using them completely. +This proposal improves the security of using things such as classloading, reflection, unsafe blocks, native code, etc., +but doesn't prevent us from using them completely. In the case of failed communication with the CA, we propose to show a big red scary warning pop up, with the classic "Here be dragons!" warning and "I know what I'm doing!" button, and give mods the permission they require to work. ### How will that work? -When sending the mod's certificate to the CA to approve, we'll append a list of permissions the mod needs to use. The CA will read the mod data and the permissions, and tell us if the mod is secure. If it is, we'll load it. +When sending the mod's certificate to the CA to approve, we'll append a list of permissions the mod needs to use. +The CA will read the mod data and the permissions, and tell us if the mod is secure. +If it is, we'll load it. #### Tech Talk -There are three ways to implement the check for forbidden code. We propose to require a modloader to implement at least two of them. +There are three ways to implement the check for forbidden code. +We propose to require a mod-loader to implement at least two of them. 1. **Java Agent** - requires an argument to the `java` command. 2. **Custom Classloader** - implementing `ClassLoader` and delegating to the original one after some checks. There are two variations of this method: - - **Plural Classloader** - creating a new classloader per mod. - - **Singular Classloader** - creating a single custom classloader, that'll use the stack trace to see what mod has invoked what. Will require additional security measures, such as using Java 9's modules. -3. **ASM Scan** - inspecting the jar with ASM before even loading it. This is the slowest method of all, although debatably the safest. + - **Plural Classloader** - creating a new classloader per mod. + - **Singular Classloader** - creating a single custom classloader, that'll use the stack trace to see what mod has invoked what. Will require additional security measures, such as using Java 9's modules. +3. **ASM Scan** - inspecting the jar with ASM before even loading it. This is the slowest method of all, although debatable-y the safest. ### But won't someone Mixin into another mod, stealing their permissions? @@ -51,7 +56,7 @@ We propose creating *two* Mixin permissions: 1. `mixin` - allows to Mixin Minecraft classes. 2. `mixin-elevated` - allows to Mixin other mods. -This will improve the security of Mixins - although we check for forbidden code in the mixin package, too. +This will improve the security of Mixins—although we check for forbidden code in the mixin package, too. ### Examples of dangerous packages *[Source](https://docs.google.com/document/d/1EpynBXdKLD69F0F0nk-Sph3FXd18IMs8PhXENB7dl6g/edit#heading=h.b4y2p3mjmgab); Credit to the [MoCKoGE](https://GitHub.com/LaylaMeower/MoCKoGE) community, especially [NerjalNosk](https://github.com/NerjalNosk)* From b0243467342a2c5498cf4e27cffd40de9265a66f Mon Sep 17 00:00:00 2001 From: laxla <127752744+LaylaMeower@users.noreply.github.com> Date: Mon, 12 Jun 2023 05:59:41 +0300 Subject: [PATCH 5/8] Renamed Proposal "Permissions API" -> "Capabilities API" --- .../README.md | 42 +++++++++++------- .../sodium_unsafe.png} | Bin 2 files changed, 27 insertions(+), 15 deletions(-) rename docs/public-identity-infra/proposals/{permissions-api => capabilities-api}/README.md (73%) rename docs/public-identity-infra/proposals/{permissions-api/soidum_unsafe.png => capabilities-api/sodium_unsafe.png} (100%) diff --git a/docs/public-identity-infra/proposals/permissions-api/README.md b/docs/public-identity-infra/proposals/capabilities-api/README.md similarity index 73% rename from docs/public-identity-infra/proposals/permissions-api/README.md rename to docs/public-identity-infra/proposals/capabilities-api/README.md index 0099bdd..9d07f19 100644 --- a/docs/public-identity-infra/proposals/permissions-api/README.md +++ b/docs/public-identity-infra/proposals/capabilities-api/README.md @@ -1,6 +1,9 @@ -> ***Note:** this is a draft.* -# Permissions API -This document proposes locking dangerous packages and classes, and allowing the trust root to give mods permissions to access locked classes. +> ***Note:** this is a draft. **Constructive** criticism will be welcomed.* +# Capabilities API +This document proposes locking dangerous packages and classes, +and allowing CAs to give mods capablities to access forbidden classes. + +Formerly known as the Permissions API. ### Proposal Contributors - [Laxla](https://github.com/LaylaMeower) @@ -19,26 +22,26 @@ This document proposes locking dangerous packages and classes, and allowing the - Allowing CAs to monopolize mod features - Defining what will happen to a CA when breaking the trust laws, nor defining said trust laws - Deciding *how* jars will be signed -- Defining the process that CAs should go through before allowing permissions (that is their own thing to figure out) +- Defining the process that CAs should go through before giving capabilities (that is their own thing to figure out) ## Proposal While signing is useful for checking mods weren't modified or infected, it has lots more potential—we can send much more than simply, "hey, this is the mod!". We can tell the CA more, for example, that this mod wants to use unsafe code, or natives, or Mixins... -We propose to add a permissions API that allows mods to use forbidden packages and classes. +We propose to add a capabilities API that allows mods to use forbidden packages and classes, under approval from the CA. This proposal improves the security of using things such as classloading, reflection, unsafe blocks, native code, etc., but doesn't prevent us from using them completely. In the case of failed communication with the CA, we propose to show a big red scary warning pop up, -with the classic "Here be dragons!" warning and "I know what I'm doing!" button, and give mods the permission they require to work. +with the classic "Here be dragons!" warning and "I know what I'm doing!" button, +and give mods the capabilities they need to work. ### How will that work? -When sending the mod's certificate to the CA to approve, we'll append a list of permissions the mod needs to use. -The CA will read the mod data and the permissions, and tell us if the mod is secure. -If it is, we'll load it. +When sending the mod's certificate to the CA to approve, we'll append a list of capabilities the mod needs. +The CA will take these capabilities into account, and may reject the certificate we've sent. #### Tech Talk @@ -50,22 +53,29 @@ We propose to require a mod-loader to implement at least two of them. - **Singular Classloader** - creating a single custom classloader, that'll use the stack trace to see what mod has invoked what. Will require additional security measures, such as using Java 9's modules. 3. **ASM Scan** - inspecting the jar with ASM before even loading it. This is the slowest method of all, although debatable-y the safest. -### But won't someone Mixin into another mod, stealing their permissions? +### But won't someone Mixin into another mod, "stealing" their capabilities? -We propose creating *two* Mixin permissions: -1. `mixin` - allows to Mixin Minecraft classes. -2. `mixin-elevated` - allows to Mixin other mods. +We're proposing two solutions: +1. Creating *two* Mixin capabilities (note that mixing somewhere still requires the capability to use the target class): + 1. `mixin` - allows to Mixin Minecraft classes. + 2. `mixin-elevated` - allows to Mixin other mods. +2. Creating a _dynamic_ mixin capability, `mixin-$package` - listing all mixin targets to the CA. This will improve the security of Mixins—although we check for forbidden code in the mixin package, too. +### But won't that delay mod reviews by a lot? + +Yes, unfortunately. + ### Examples of dangerous packages - *[Source](https://docs.google.com/document/d/1EpynBXdKLD69F0F0nk-Sph3FXd18IMs8PhXENB7dl6g/edit#heading=h.b4y2p3mjmgab); Credit to the [MoCKoGE](https://GitHub.com/LaylaMeower/MoCKoGE) community, especially [NerjalNosk](https://github.com/NerjalNosk)* +*[Source](https://docs.google.com/document/d/1EpynBXdKLD69F0F0nk-Sph3FXd18IMs8PhXENB7dl6g/edit#heading=h.b4y2p3mjmgab); Credit to the [MoCKoGE](https://GitHub.com/LaylaMeower/MoCKoGE) community, especially [NerjalNosk](https://github.com/NerjalNosk)* * `java.io` - Direct access to the file system is dangerous. * `java.nio` - same as above. * `sun.nio` - Another file I/O alternative * `java.lang.ClassLoader` - Allows restriction bypass * `jdk.internal` - Provides access to the JVM internal aspects (e.g., a variation of ASM) * `sun.misc.Unsafe` - Allows bypassing the restrictions set here. +* `java.lang.ProcessBuilder` - allows running arbitrary code * `java.reflect` - allows to modify code. * `java.lang.reflect` - core part of the above package. * `java.lang.Package` - ensues reflection exposition. @@ -89,9 +99,11 @@ This will improve the security of Mixins—although we check for forbidden code * `org.objectweb.asm` - ASM can be used to modify bytecode on runtime. Yes, it's another reflection alternative. And it's VERY powerful. * `org.spongepowered.asm` - Yes indeed, we're suggesting to restrict the mixin library. It can be used to modify other mod's behaviors. +Note this list is a WIP, and contributions will be welcome. + ## Alternatives - _Simply have "loader plugins" that execute without blocking access to special classes._ Popular mods such as sodium use lots of unsafe code, - ![Discord message from IMS](soidum_unsafe.png) + ![IMS, Admin: sodium already needs unsafe for like 50% of the codebase](sodium_unsafe.png "Discord message from IMS") and a big warning window every time you open Minecraft with sodium can be very irritating. - *Don't block dangerous code at all.* But we're talking security, and that's unsecure. \ No newline at end of file diff --git a/docs/public-identity-infra/proposals/permissions-api/soidum_unsafe.png b/docs/public-identity-infra/proposals/capabilities-api/sodium_unsafe.png similarity index 100% rename from docs/public-identity-infra/proposals/permissions-api/soidum_unsafe.png rename to docs/public-identity-infra/proposals/capabilities-api/sodium_unsafe.png From 3a0e81eaef979e714be744a2a5b514ac64dac7d8 Mon Sep 17 00:00:00 2001 From: laxla <127752744+LaylaMeower@users.noreply.github.com> Date: Mon, 12 Jun 2023 06:08:32 +0300 Subject: [PATCH 6/8] Proposed Okio --- .../proposals/capabilities-api/README.md | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/docs/public-identity-infra/proposals/capabilities-api/README.md b/docs/public-identity-infra/proposals/capabilities-api/README.md index 9d07f19..cad510d 100644 --- a/docs/public-identity-infra/proposals/capabilities-api/README.md +++ b/docs/public-identity-infra/proposals/capabilities-api/README.md @@ -67,6 +67,20 @@ This will improve the security of Mixins—although we check for forbidden code Yes, unfortunately. +### Wait, but what about the file system? + +We propose to create a _cross-mod-loader_ API +(as in, the same signature in all mod-loaders; not necessarily the same implementation) +to allow mods to read and write files from the `.minecraft/config` directory, +and the `~/.minecraft/config/global` directory. + +#### Tech Talk + +This could be done by using the `okio` library, +blocking the `okio.FileSystem.SYSTEM`, `okio.FileSystem.Companion.SYSTEM` +and `okio.FileSystem.Companion.getSYSTEM()` code elements, +and creating custom file systems that mods will be able to use (`GlobalConfigFileSystem` and `LocalConfigFileSystem`). + ### Examples of dangerous packages *[Source](https://docs.google.com/document/d/1EpynBXdKLD69F0F0nk-Sph3FXd18IMs8PhXENB7dl6g/edit#heading=h.b4y2p3mjmgab); Credit to the [MoCKoGE](https://GitHub.com/LaylaMeower/MoCKoGE) community, especially [NerjalNosk](https://github.com/NerjalNosk)* * `java.io` - Direct access to the file system is dangerous. From e2c6ecb3acb054b3ba1dba4d21b7deed20ebb900 Mon Sep 17 00:00:00 2001 From: laxla <127752744+LaylaMeower@users.noreply.github.com> Date: Mon, 12 Jun 2023 06:25:12 +0300 Subject: [PATCH 7/8] Capability Proposal Don't remember what I changed --- .../proposals/capabilities-api/README.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/docs/public-identity-infra/proposals/capabilities-api/README.md b/docs/public-identity-infra/proposals/capabilities-api/README.md index cad510d..29ce542 100644 --- a/docs/public-identity-infra/proposals/capabilities-api/README.md +++ b/docs/public-identity-infra/proposals/capabilities-api/README.md @@ -1,7 +1,7 @@ > ***Note:** this is a draft. **Constructive** criticism will be welcomed.* # Capabilities API This document proposes locking dangerous packages and classes, -and allowing CAs to give mods capablities to access forbidden classes. +and allowing CAs to give mods capabilities to access forbidden classes. Formerly known as the Permissions API. @@ -12,7 +12,7 @@ Formerly known as the Permissions API. - [This discussion](https://discord.com/channels/1115852272245686334/1117392205787693107/1117454247529812115) in the MMPA discord, in `#wg-public` ### Definitions -- **CA** - Certificate Authority +- **CA** - Certificate/Capability Authority, see [the working group](../../README.md). ## Goals - Preventing mods from accessing dangerous packages From 493b08291223418ac1ae181190b9fff44c9ab4ff Mon Sep 17 00:00:00 2001 From: laxla <127752744+LaylaMeower@users.noreply.github.com> Date: Mon, 12 Jun 2023 06:30:43 +0300 Subject: [PATCH 8/8] Added dots at the end of sentences. --- .../proposals/capabilities-api/README.md | 42 +++++++++---------- 1 file changed, 21 insertions(+), 21 deletions(-) diff --git a/docs/public-identity-infra/proposals/capabilities-api/README.md b/docs/public-identity-infra/proposals/capabilities-api/README.md index 29ce542..e0076ff 100644 --- a/docs/public-identity-infra/proposals/capabilities-api/README.md +++ b/docs/public-identity-infra/proposals/capabilities-api/README.md @@ -1,7 +1,7 @@ > ***Note:** this is a draft. **Constructive** criticism will be welcomed.* # Capabilities API This document proposes locking dangerous packages and classes, -and allowing CAs to give mods capabilities to access forbidden classes. +and allowing CAs to give a mod capabilities, allowing it to access forbidden classes. Formerly known as the Permissions API. @@ -85,35 +85,35 @@ and creating custom file systems that mods will be able to use (`GlobalConfigFil *[Source](https://docs.google.com/document/d/1EpynBXdKLD69F0F0nk-Sph3FXd18IMs8PhXENB7dl6g/edit#heading=h.b4y2p3mjmgab); Credit to the [MoCKoGE](https://GitHub.com/LaylaMeower/MoCKoGE) community, especially [NerjalNosk](https://github.com/NerjalNosk)* * `java.io` - Direct access to the file system is dangerous. * `java.nio` - same as above. -* `sun.nio` - Another file I/O alternative -* `java.lang.ClassLoader` - Allows restriction bypass -* `jdk.internal` - Provides access to the JVM internal aspects (e.g., a variation of ASM) +* `sun.nio` - Another file I/O alternative. +* `java.lang.ClassLoader` - Allows restriction bypass. +* `jdk.internal` - Provides access to the JVM internal aspects (e.g., a variation of ASM). * `sun.misc.Unsafe` - Allows bypassing the restrictions set here. -* `java.lang.ProcessBuilder` - allows running arbitrary code +* `java.lang.ProcessBuilder` - allows running arbitrary code. * `java.reflect` - allows to modify code. * `java.lang.reflect` - core part of the above package. * `java.lang.Package` - ensues reflection exposition. -* `kotlin.reflect.full` - A branch of the kotlin reflection library (`kotlin.reflect`) that also allows modification +* `kotlin.reflect.full` - A branch of the kotlin reflection library (`kotlin.reflect`) that also allows modification. * `sun.reflect` - regular reflection alternative -* `java.lang.runtime` - another reflection alternative -* `java.lang.invoke` - yet another reflection alternative -* `java.lang.instrument` - Agents and bytecode injection -* `java.lang.constant` - not really sensible, but only really useful for Java internals, and using it shouldn’t be considered -* `java.lang.Compiler` - runtime compiler accessor -* `java.lang.Console` - Provides access to many JVM-controlling functions -* `java.lang.System` - seems fairly explicit as for how that can be sensible +* `java.lang.runtime` - another reflection alternative. +* `java.lang.invoke` - yet another reflection alternative. +* `java.lang.instrument` - Agents and bytecode injection. +* `java.lang.constant` - not really sensible, but only really useful for Java internals, and using it shouldn’t be considered. +* `java.lang.Compiler` - runtime compiler accessor. +* `java.lang.Console` - Provides access to many JVM-controlling functions. +* `java.lang.System` - seems fairly explicit as for how that can be sensible. * `java.lang.LiveStackFrame` - JVM bug, intended to be package private. -* `java.lang.Runtime` - includes System-related methods. Only accessible ones should be provided via a façade -* `java.lang.Shutdown` - Can force-stop process (alternative to `System.exit()`) -* `java.lang.Terminator` - yet another alternative to `System.exit()` -* `java.lang.StackWalker` - More of a safety issue, can be exploited to know more of the already run code. -* `java.rmi` - Remote Method Invocation can cause some fairly serious security issues when it comes to multi-device connections -* `javax.rmi` - Alternative for the above -* `sun.rmi` - Yet another RMI alternative +* `java.lang.Runtime` - includes System-related methods. Only accessible ones should be provided via a façade. +* `java.lang.Shutdown` - Can force-stop process (alternative to `System.exit()`). +* `java.lang.Terminator` - yet another alternative to `System.exit()`. +* `java.lang.StackWalker` - Can be exploited to know more of the already run code. Still under debate. +* `java.rmi` - Remote Method Invocation can cause some fairly serious security issues when it comes to multi-device connections. +* `javax.rmi` - Alternative for the above. +* `sun.rmi` - Yet another RMI alternative. * `org.objectweb.asm` - ASM can be used to modify bytecode on runtime. Yes, it's another reflection alternative. And it's VERY powerful. * `org.spongepowered.asm` - Yes indeed, we're suggesting to restrict the mixin library. It can be used to modify other mod's behaviors. -Note this list is a WIP, and contributions will be welcome. +> ***Note:** this list is a WIP, and contributions are welcomed.* ## Alternatives - _Simply have "loader plugins" that execute without blocking access to special classes._