# SAFE and -T command line option

**URL:** <https://www.ruby-forum.com/t/safe-and-t-command-line-option/86176>\
**Category:** Ruby\
**Created:** [February 20, 2007, 12:42pm UTC](https://www.ruby-forum.com/t/safe-and-t-command-line-option/86176 "2007-02-20T12:42:03Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![jspencer78](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/f14d63/32.png) [@jspencer78](https://www.ruby-forum.com/u/jspencer78)\
**Post date:** [February 20, 2007, 12:42pm UTC](https://www.ruby-forum.com/t/safe-and-t-command-line-option/86176/1 "2007-02-20T12:42:03Z")

</div>

Hello,

I was wondering if someone knew the syntax for setting the safe level  
using the -T command line option. Here is my code:

IO.popen(“ruby -r userlib program.rb”, “r+”)

I need to set the safe level of the ‘program.rb’ file

Any ideas?

---

<div class="post-metadata">

**Author:** ![jspencer78](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/f14d63/32.png) [@jspencer78](https://www.ruby-forum.com/u/jspencer78)\
**Post date:** [February 20, 2007, 1:49pm UTC](https://www.ruby-forum.com/t/safe-and-t-command-line-option/86176/2 "2007-02-20T13:49:28Z")

</div>

On Tue, 20 Feb 2007 12:42:07 +0100, James S. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

> Hello,
> 
> I was wondering if someone knew the syntax for setting the safe level  
> using the -T command line option. Here is my code:

C:\CCM\_WA\ccm\_wa\vpn\mqo\_client\_impl,vallnerd\>echo puts $SAFE \> foo.rb

C:\CCM\_WA\ccm\_wa\vpn\mqo\_client\_impl,vallnerd\>ruby foo.rb  
0

C:\CCM\_WA\ccm\_wa\vpn\mqo\_client\_impl,vallnerd\>ruby -T foo.rb  
1

C:\CCM\_WA\ccm\_wa\vpn\mqo\_client\_impl,vallnerd\>ruby -T2 foo.rb  
2

C:\CCM\_WA\ccm\_wa\vpn\mqo\_client\_impl,vallnerd\>ruby -T3 foo.rb  
3

C:\CCM\_WA\ccm\_wa\vpn\mqo\_client\_impl,vallnerd\>ruby -T4 foo.rb  
foo.rb:1:in `write': Insecure operation `write’ at level 4  
(SecurityError)  
from foo.rb:1:in `puts’  
from foo.rb:1

---

<div class="post-metadata">

**Author:** ![jspencer78](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/f14d63/32.png) [@jspencer78](https://www.ruby-forum.com/u/jspencer78)\
**Post date:** [February 20, 2007, 3:38pm UTC](https://www.ruby-forum.com/t/safe-and-t-command-line-option/86176/3 "2007-02-20T15:38:44Z")

</div>

Thanks for your comments…

I’m trying:

ruby -r userlib -T3 program.rb

This doesn’t seem to be working with the -r option (i also want to load  
in the file userlib.rb) - are the two options compatible together?

---

<div class="post-metadata">

**Author:** ![jspencer78](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/j/f14d63/32.png) [@jspencer78](https://www.ruby-forum.com/u/jspencer78)\
**Post date:** [February 20, 2007, 4:40pm UTC](https://www.ruby-forum.com/t/safe-and-t-command-line-option/86176/4 "2007-02-20T16:40:17Z")

</div>

On Tue, 20 Feb 2007 15:38:52 +0100, James S. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)  
wrote:

> Thanks for your comments…
> 
> I’m trying:
> 
> ruby -r userlib -T3 program.rb
> 
> This doesn’t seem to be working with the -r option (i also want to load  
> in the file userlib.rb) - are the two options compatible together?

Quoth the Pickaxe, ed. 1: “\>= 2 – Ruby prohibits the loading of program  
files from globally writable locations.”

D:\UserPrfs\VALLNERD\>type foo.rb  
require “yaml”  
y [1, 2, {:foo =\> ‘bar’}]

Amusingly enough:

D:\UserPrfs\VALLNERD\>attrib -R /s c:\ruby\lib\*

## D:\UserPrfs\VALLNERD\>ruby -T2 foo.rb

- 1
- 2
- :foo: bar

(So either that has been changed since the first edition, or the win32  
port plain doesn’t even try to do that check.)

D:\UserPrfs\VALLNERD\>ruby -T2 -ryaml foo.rb  
ruby: no -r allowed in tainted mode (SecurityError)

. o 0 (WTF.) I have no idea what’s going on there, besides the  
interpreter  
obviously evaluating even arguments it’s supposed to parse  
order-dependently.

## D:\UserPrfs\VALLNERD\>ruby -ryaml -T2 foo.rb

- 1
- 2
- :foo: bar

While:

D:\UserPrfs\VALLNERD\>attrib +R /s c:\ruby\lib\*

D:\UserPrfs\VALLNERD\>ruby -ryaml -T3 foo.rb  
ruby: Insecure operation: -r (SecurityError)

D:\UserPrfs\VALLNERD\>ruby -T3 -ryaml foo.rb  
ruby: no -r allowed in tainted mode (SecurityError)

D:\UserPrfs\VALLNERD\>ruby -T3 foo.rb  
foo.rb:1:in `require’: Insecure operation - require (SecurityError)  
from foo.rb:1

still breaks, even though Pickaxe ed. 1 doesn’t mention further code  
loading restrictions. (This doesn’t mean much, while two major versions  
of  
development do.) Alas, my Pickaxe 2 is on a non-working USB stick and  
(hopefully) another computer, so some $SAFE-guru could clarify this.