Programming Perl, 4th Edition

Safe Compartments

The Safe module lets you set up a sandbox, a special compartment in which all system operations are trapped, and namespace access is carefully controlled. The low-level, technical details of this module are in a state of flux, so here we’ll take a more philosophical approach.

Restricting namespace access

At the most basic level, a Safe object is like a safe, except the idea is to keep the bad people in, not out. In the Unix world, there is a syscall known as chroot(2) that can permanently consign a process to running only in a subdirectory of the directory structure—in its own private little hell, if you will. Once the process is put there, there is no way for it to reach files outside, because there’s no way for it to name files outside.^[202]

A Safe object is a little like chroot(2), except that instead of being restricted to a subset of the filesystem’s directory structure, it’s restricted to a subset of Perl’s package structure, which is hierarchical just as the filesystem is.

Another way to look at it is that the Safe object is like one of those observation rooms with one-way mirrors where the police put suspicious characters. People on the outside can look into the room, but those inside can’t see out.

When you create a Safe object, you may give it a package name if you want. If you don’t, a new one will be chosen for you:

use Safe;
my $sandbox = Safe–>new("Dungeon");
$Dungeon::foo = 1;  # Direct access is discouraged, though.

If you fully qualify variables and functions ...