Newsgroups: php.internals
Path: news.php.net
Xref: news.php.net php.internals:124823
Precedence: bulk
MIME-Version: 1.0
References: <e08f6af322dcc5b4e4dd5e772f28be07ffa07ba4.camel@ageofdream.com>
 <c510eb675bd0038efbbe5489bebd42ff7438e967.camel@ageofdream.com>
 <7d9a9752-a202-4099-a60a-2686d4265d96@gmail.com> <ffc9c850-06f1-4937-be55-b9e2cc614dfb@app.fastmail.com>
 <d39df742995d29e7db245891c517f0e2b68b041a.camel@ageofdream.com>
In-Reply-To: <d39df742995d29e7db245891c517f0e2b68b041a.camel@ageofdream.com>
Date: Wed, 7 Aug 2024 19:49:30 +0700
Message-ID: <CAEZPtU6c5j=6KRrZQssPg4TDC2Udc8j8uK338ucgUtQVaUdrrA@mail.gmail.com>
Subject: Re: [PHP-DEV] [Discussion] Sandbox API
To: Nick Lockheart <lists@ageofdream.com>
Cc: PHP internals <internals@lists.php.net>
Content-Type: multipart/alternative; boundary="000000000000007d9f061f17585a"
From: pierre.php@gmail.com (Pierre Joye)

--000000000000007d9f061f17585a
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

On Wed, Aug 7, 2024, 7:13=E2=80=AFPM Nick Lockheart <lists@ageofdream.com> =
wrote:

>
>
>
> So I was thinking about this a bit more and I thought, what if instead
> of adding a sandbox as a feature of PHP, what if PHP *was* the sandbox.
>
> So consider this:
>
> What if the PHP engine added a C API that lets C/C++ programs not only
> spin up and run PHP, but those C/C++ programs could also control and
> monitor the execution of the PHP environment from the outside.
>


Something similar is done in things like frankenphp (go/caddi/own sapi) or
nativephp (desktop app, afair rust/tauri).

Not the same goal, same starting point.

But I would stay away to replace, or improve, OS security with my own
things. Totally possible but it is the kind of worms can I don't look
forward to open  :)

>

--000000000000007d9f061f17585a
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"auto"><div><br><br><div class=3D"gmail_quote"><div dir=3D"ltr" =
class=3D"gmail_attr">On Wed, Aug 7, 2024, 7:13=E2=80=AFPM Nick Lockheart &l=
t;<a href=3D"mailto:lists@ageofdream.com">lists@ageofdream.com</a>&gt; wrot=
e:<br></div><blockquote class=3D"gmail_quote" style=3D"margin:0 0 0 .8ex;bo=
rder-left:1px #ccc solid;padding-left:1ex"><br><br>
<br>
So I was thinking about this a bit more and I thought, what if instead<br>
of adding a sandbox as a feature of PHP, what if PHP *was* the sandbox.<br>
<br>
So consider this:<br>
<br>
What if the PHP engine added a C API that lets C/C++ programs not only<br>
spin up and run PHP, but those C/C++ programs could also control and<br>
monitor the execution of the PHP environment from the outside.<br></blockqu=
ote></div></div><div dir=3D"auto"><br></div><div dir=3D"auto"><br></div><di=
v dir=3D"auto">Something similar is done in things like frankenphp (go/cadd=
i/own sapi) or nativephp (desktop app, afair rust/tauri).</div><div dir=3D"=
auto"><br></div><div dir=3D"auto">Not the same goal, same starting point.</=
div><div dir=3D"auto"><br></div><div dir=3D"auto">But I would stay away to =
replace, or improve, OS security with my own things. Totally possible but i=
t is the kind of worms can I don&#39;t look forward to open=C2=A0 :)</div><=
div dir=3D"auto"><div class=3D"gmail_quote"><blockquote class=3D"gmail_quot=
e" style=3D"margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
</blockquote></div></div></div>

--000000000000007d9f061f17585a--