Filesystem

Filesystem

Directly accessing the filesystem triggers a security elevation. However, we can include a filesystem interface that can be accessed without the security elevation.

The interface version is useful. First - it means that a library cannot secretly access the filesystem, it has to request access. Second, we can create a virtual filesystem to sandbox an application. The sandbox can even be persistened. We can also add alerts so that if a library tries to do something suspicious (like accessing os files), we can track it.

We can also create an intermediary that does allow direct access to the filesystem but limits what files and directories are shown.

Embedded Resources

Files can be embedded via glob matching. In debug mode, there is an option to keep these resources up to date. When the program is compiled, they are statically embedded as resources.

Not quite sure how this interacts with packages. The application can definitely set this up. Though it may be better for the modules to do it. Libraries should not set this up, but they can access them without triggering a security elevation.