Sandboxing

TRILL on SWISH cannot provide unrestricted access to Prolog because Prolog gives unrestricted access to the operating system. Therefore, SWISH examines each goal on safety before execution. This process unfolds the call-tree and verifies all called predicates against a whitelist. It fails on three occasions:

• If insufficient information is available to decide what will be called. E.g., ?- read(X), call(X). Such errors are raised as instantiation errors.
• If a predicate is found that is not whitelisted. Such errors are raised as permission errors
• If a called predicate is not defined. Such errors are raised as existence errors

If any of the above happens, the error is printed, along with a chain of intermediate goals that should help finding the culprit. Note that the whitelist is incomplete, i.e., there are many predicates that can be considered safe that are not on the list. Please report such omissions as bugs.