Re: package security auditing and isolation

[Yuri Khan]

On Thu, Apr 6, 2017 at 9:15 PM, Ted Zlatanov <address@hidden> wrote:

> 2) establishing isolation levels in the C core. Simply put, not all
> packages need to be able to run shell commands, delete or modify files,
> and so on. When the user installs or updates a package, if the needed
> access levels change, that should be noted and acknowledged.

“This package is requesting the following permissions:

* Monitor all your keystrokes
* Modify buffer contents
* Access the kill ring
* Read and write files”