title: Capabilities for Lua: what experience is there?
body: <p>There's been <a href="http://www.eros-os.org/pipermail/cap-talk/2009-July/thread.html#13043" rel="nofollow noreferrer">some discussion on the <code>cap-talk</code> mailing list</a> around whether Lua and Javascript support the object-capability model, with the conclusion that because of support for restricting the environment to called functions through <code>setfenv</code>, and the possibility of unforgeable references to immutable objects, the OCM could be implemented.</p>
  
  <p>Have we seen how this works out?  I'm interested in removing exploits from an existing application with very useful, generous scripting support in Lua that unfortunately allows full shell access in all kinds of cases.  Some shell access is needed: the object-capability model seems like a good way to manage things.  But I worry about how convincing a case I can make that this approach will actually be verifiably secure in the sure-to-be messy practice.</p>
  
  <p>Some links:</p>
  
  <ol>
  <li>Older SO question: <a href="https://stackoverflow.com/questions/1224708/how-can-i-create-a-secure-lua-sandbox">How can I create a secure Lua sandbox?</a></li>
  <li>Background at erights.org: <a href="http://www.erights.org/elib/capability/ode/ode-capabilities.html" rel="nofollow noreferrer">From Objects To Capabilities</a></li>
  <li>Lua wiki: <a href="http://lua-users.org/wiki/SandBoxes" rel="nofollow noreferrer">SandBoxes</a> and <a href="http://lua-users.org/wiki/ReadOnlyTables" rel="nofollow noreferrer">ReadOnlyTables</a> - shows <code>setfenv</code> in action; shows basic idea behind tables that can, under the right circumstances, be made read only</li>
  </ol>