{"size": 2005, "ext": "scrbl", "max_stars_repo_path": "pkgs/racket-doc/scribblings/inside/security.scrbl", "max_stars_repo_name": "lkh01/racket", "max_stars_repo_stars_event_min_datetime": "2018-07-05T21:18:24.000Z", "max_stars_repo_stars_event_max_datetime": "2021-06-04T14:48:37.000Z", "max_issues_repo_path": "pkgs/racket-doc/scribblings/inside/security.scrbl", "max_issues_repo_name": "lkh01/racket", "max_issues_repo_issues_event_min_datetime": "2017-05-10T07:33:20.000Z", "max_issues_repo_issues_event_max_datetime": "2018-07-19T15:49:46.000Z", "max_forks_repo_path": "pkgs/racket-doc/scribblings/inside/security.scrbl", "max_forks_repo_name": "lkh01/racket", "max_forks_repo_forks_event_min_datetime": "2016-04-25T11:47:57.000Z", "max_forks_repo_forks_event_max_datetime": "2017-05-09T14:52:48.000Z"}
{"max_stars_count": 4, "max_issues_count": 9, "max_forks_count": 3, "avg_line_length": 32.868852459, "max_line_length": 74, "alphanum_fraction": 0.7306733167}
#lang scribble/doc
@(require "utils.rkt")

@title[#:tag "security"]{Security Guards}

Before a primitive procedure accesses the filesystem or creates a
network connection, it should first consult the current security guard
to determine whether such access is allowed for the current thread.

File access is normally preceded by a call to
@cppi{scheme_expand_filename}, which accepts flags to indicate the
kind of filesystem access needed, so that the security guard is
consulted automatically.

An explicit filesystem-access check can be made by calling
@cpp{scheme_security_check_file}. Similarly, an explicit
network-access check is performed by calling
@cpp{scheme_security_check_network}.

@; ----------------------------------------------------------------------


@function[(void scheme_security_check_file
           [const-char* who]
           [char* filename]
           [int guards])]{

Consults the current security manager to determine whether access is
allowed to @var{filename}. The @var{guards} argument should be a
bitwise combination of the following:

@itemize[

 @item{@cppi{SCHEME_GUARD_FILE_READ}}
 @item{@cppi{SCHEME_GUARD_FILE_WRITE}}
 @item{@cppi{SCHEME_GUARD_FILE_EXECUTE}}
 @item{@cppi{SCHEME_GUARD_FILE_DELETE}}
 @item{@cppi{SCHEME_GUARD_FILE_EXISTS} (do not combine with other values)}

]

The @var{filename} argument can be @cpp{NULL} (in which case
@racket[#f] is sent to the security manager's procedure), and
@var{guards} should be @cppi{SCHEME_GUARD_FILE_EXISTS} in that case.

If access is denied, an exception is raised.}


@function[(void scheme_security_check_network
           [const-char* who]
           [char* host]
           [int portno])]{

Consults the current security manager to determine whether access is
 allowed for creating a client connection to @var{host} on port number
 @var{portno}. If @var{host} is @cpp{NULL}, the security manager is
 consulted for creating a server at port number @var{portno}.

If access is denied, an exception is raised.}

