permit_only#

Opcode::permit_only($safe, @ops), Opcode::permit($safe, @ops), Opcode::deny_only($safe, @ops), Opcode::deny($safe, @ops): change the operator mask of a compartment object - any blessed hash, such as a Safe, whose Mask entry is an opset (created when missing). The operators are given as names, :tags and opsets; a name with a leading ! counts inverted.

Also available as Opcode::permit, Opcode::deny_only, Opcode::deny.

  • permit allows the named operators, deny forbids them, both on top of the current mask;

  • permit_only allows the named operators and forbids every other; deny_only forbids the named ones and allows every other.

my $c = Safe->new;
Opcode::permit_only($c, ':default');
Opcode::deny($c, 'print');
$c->reval('print "x"');     # 'print' trapped by operation mask

Safe’s methods of the same names are its own Perl code over opset; these are the older XS versions. Anything but a blessed hash dies “Not a Safe object”.