Clojure Security: Information Flow + Capability System

Question

Summary

Is there something like http://en.wikipedia.org/wiki/E_programming_language as a DSL inside of Clojure?

Background

I'm aware of:

• http://bit.ly/N4jnTI and http://bit.ly/Lm3SSD

  However, neither provides what I want.

Context

I'm a big fan of both capability systems and information flow. And I'm wondering if anyone has developed Clojure DSLs for these two techniques. The following would be ideal:

• all objects have some tag (say in it's meta table) that lists who has read access to the object

• when I want to run a query as user "foo", I set some context var saying "now, use only the capabilities of foo" -- then the function, when it tries to reach objects, either gets the object (if foo has access to it) or nil (if foo does not have access to it). Leaking information bout the existence of objects is not a big deal to me at the moment.

Question

So the question is -- is this something easy to do as a Clojure DSL? Where each object has some capability tag, and we can execute pieces of function/code under certain tags, and the runtime system makes sure that no one gets access to things they're not supposed to access.

Thanks!

Answer 1

you can do this with metadata and preconditions and then create macros to add a DSL/syntax to it, though I would recommend skipping the macros and going for just preconditions and metadata.

• Each object would have a piece of metadata with a list of it's capabilities.
• Each function would have a precondition that checked the metadata.