Practical Programming in Tcl & Tk, Third Edition

Safe Interpreters

A child can be created either safe (i.e., untrusted) or fully functional. In the examples so far, the children have been trusted and fully functional; they have all the basic Tcl commands available to them. An interpreter is made safe by eliminating certain commands. Table 19-2 lists the commands removed from safe interpreters. As described later, these commands can be used by the master on behalf of the safe interpreter. To create a safe interpreter, use the -safe flag:

interp create -safe untrusted

Table 19-2. Commands hidden from safe interpreters.

cd	Changes directory.
exec	Executes another program.
exit	Terminates the process.
fconfigure	Sets modes of an I/O stream.
file	Queries file attributes.
glob	Matches on file name patterns. ...