Inner sandbox, the NaCl module:
No instructions or pseudo-instrucitons in the binary crosses a bundle boundary.
All rules above are checked by a verifier brefore a program is executed. This verifier with the runtime system comprise NaCl’s trusted computing base (TCB).
Outer sandbox: system call interposition
(From Chapter 2, page 3) Native Client is ideal for application components requiring pure computation. It is not appropriate for modules requiring process creation, direct file system access, or unrestricted access to the network.
Inter-Module Communications (IMC) for general inter-component communication;used by both trusted and untrusted components, such as the trusted JavaScript components, NaCl browser plugin, and untrusted NaCl modules.
Communicate between Browser and NaCl module:
“service runtime” and NaCl module:
sysbrk(), mmap(), malloc()/free()(From 2.3, page 4): In addition to the inner and outer sandbox, the system design also incorporates CPU blacklist and NaCl module blacklist. ==> ??? What is the CPU black-list, NaCl black-lists????
Native Client applies concepts of software isolation and proof-carrying code that have been extensively discussed in the research literature.
NaCl data integrity scheme is a straightforward application of segmented memory as implemented in the Intel 80386.
NaCl control flow integrity technique builds on the seminal work by Wahbe, Lucco, Anderson and Graham5. Native Client extends this previous work with specific mechanisms to achieve safety for the x86 ring-3 instruction set archtecture, using several techniques first described by McCamant and Morrisett6.
NaCl uses a static validator rather than a trusted compiler, similar to validators described for other systems 6 7 8 9, applying the concept of proof-carrying code10.
Compare with CFI11:
Finer-grained CFI is not useful for Native Client:
CFI 15% on SPEC 2000. Three times higher than NaCl 5%.
XFI 9 add data dandboxing to CFI control flow checks. with additioinal overhead; NaCl get data integrity for free from x86 segments
NaCl descriptors similar mechanisms:
Hardware exceptions (segmentation faults, floating point exceptions) and external interrupts are not allowed, due in part to distinct and incompatible exception models in Linux, MacOS and Windows. Both Linux and Windows rely on the x86 stack via %esp for delivery of these events. Regrettably, since NaCl modifies the %ss segment register, the stack appears to be invalid to the operating system, such that it cannot deliver the event and the corresponding process is immediately terminated. The use of x86 segmentation for data sandboxing effectively precludes recovery from these types of exceptions.
Portable Native Client 1: control flow and memory integrity with average performance overhead of under 5% on ARM and 7% on x86-64. Introduction About previous SFI on CISC Control+store SFI on x86-32, which we considered excessive, indicates about 25% overhead. “As we continued our exploration of ARM SFI and sought to understand ARM behavior relative to x86 behavior, we could not adequately explain the observed performance gap between ARM SFI at under 10% overhead with the overhead on x86-32 in terms of instruction set differences.
If you could revise
the fundmental principles of
computer system design
to improve security...
... what would you change?