Native Client: A Sandbox for Portable, Untrusted x86 Native Code Bennet Yee, David Sehr, Gregory Dardyk, J. Bradley Chen, Robert Muth, Tavis Ormandy, Shiki Okasaka, Neha Narula, and Nicholas Fullagar Google Inc. Presented by: Gilmore R. Lundquist April 4, 2012
Overview and Goals Architecture Implementation Extras Outline Overview and Goals 1 Architecture 2 Organization NaCl Modules Communication Service Runtime Trusted NaCl Services Attack Surface Implementation 3 Sandboxing SFI / Inner Sandbox Validator Validator Performance Memory Layout Trampolines Springboard Extras 4 Presented by: Gilmore R. Lundquist Native Client
Overview and Goals Architecture Implementation Extras Outline Overview and Goals 1 Architecture 2 Organization NaCl Modules Communication Service Runtime Trusted NaCl Services Attack Surface Implementation 3 Sandboxing SFI / Inner Sandbox Validator Validator Performance Memory Layout Trampolines Springboard Extras 4 Presented by: Gilmore R. Lundquist Native Client
Overview and Goals Architecture Implementation Extras Overview Native Client (”NaCl”) is: A sandbox for untrusted x86 native code A browser-based framework Designed to: Give browser-based applications the computational performance of native applications Provide operating system portability Provide performance-oriented features Threading Instruction set extensions (e.g., SSE) Compiler intrinsics Hand-coded assembly An open architecture Presented by: Gilmore R. Lundquist Native Client
Overview and Goals Architecture Implementation Extras Computation! Running native code allows previously infeasible computations to run with your browser: Simulation of Newtonian physics Computational fluid-dynamics High-resolution scene rendering Use of languages other than JavaScript Presented by: Gilmore R. Lundquist Native Client
Overview and Goals Architecture Implementation Extras Previous Problems Native code allowed previously (e.g., ActiveX, NPAPI) Presented by: Gilmore R. Lundquist Native Client
Overview and Goals Architecture Implementation Extras Previous Problems Native code allowed previously (e.g., ActiveX, NPAPI) Problem: Native code must be trusted Browser security mechanisms are circumvented Presented by: Gilmore R. Lundquist Native Client
Overview and Goals Architecture Implementation Extras Previous Problems Native code allowed previously (e.g., ActiveX, NPAPI) Problem: Native code must be trusted Browser security mechanisms are circumvented Problem: Trust must be established manually (pop-up boxes) Presented by: Gilmore R. Lundquist Native Client
Overview and Goals Architecture Implementation Extras Previous Problems Native code allowed previously (e.g., ActiveX, NPAPI) Problem: Native code must be trusted Browser security mechanisms are circumvented Problem: Trust must be established manually (pop-up boxes) Ineffective for preventing security problems Presented by: Gilmore R. Lundquist Native Client
Overview and Goals Architecture Implementation Extras Threat Model Modules can contain arbitrary code Runtime confirms that the code conforms to validity rules Code which doesn’t conform is rejected Once accepted, module must be constrained to prevent unintended side effects Presented by: Gilmore R. Lundquist Native Client
Overview and Goals Architecture Implementation Extras Threat Model The NaCl module may: Arbitrarily combine the entire variety of behaviors permitted by the NaCl execution environment in attempting to compromise the system Execute any reachable instruction block in the validated text segment Exercise the NaCl application binary interface to access runtime services in any way: passing invalid arguments, etc. Send arbitrary data via our intermodule communication interface, with the communicating peer responsible for validating input Allocate memory and spawn threads up to resource limits Attempt to exploit race conditions in subverting the system Presented by: Gilmore R. Lundquist Native Client
Overview and Goals Architecture Implementation Extras Outline Overview and Goals 1 Architecture 2 Organization NaCl Modules Communication Service Runtime Trusted NaCl Services Attack Surface Implementation 3 Sandboxing SFI / Inner Sandbox Validator Validator Performance Memory Layout Trampolines Springboard Extras 4 Presented by: Gilmore R. Lundquist Native Client
Overview and Goals Architecture Implementation Extras Organization Figure: Hypothetical NaCl-based application with a trusted storage service. Untrusted modules have a grey background. Native Client is organized in two parts: A constrained execution environment for native code to prevent unintended side effects A runtime for hosting these native code extensions through which allowable side effects may occur safely Presented by: Gilmore R. Lundquist Native Client
Overview and Goals Architecture Implementation Extras Organization Figure: Hypothetical NaCl-based application with a trusted storage service. Untrusted modules have a grey background. Application components (untrusted): Browser component: User Interface written in HTML / JavaScript Constrained by browser Native component: NaCl module Constrained by NaCl container (inner and outer sandboxes) 32-bit executables (currently no 64-bit support) Both parts portable across OS / browser Presented by: Gilmore R. Lundquist Native Client
Overview and Goals Architecture Implementation Extras Organization Figure: Hypothetical NaCl-based application with a trusted storage service. Untrusted modules have a grey background. NaCl system components (trusted): NaCl browser plugin (OS and browser specific) Inter-component communication IMC (Inter-Module Communications) Simple Remote Procedure Call (SRPC) Netscape Plugin Application Programming Interface (NPAPI) Service runtime Trusted NaCl services (e.g., storage service) Presented by: Gilmore R. Lundquist Native Client
Overview and Goals Architecture Implementation Extras NaCl Modules NaCl modules consist of untrusted x86 code NaCl module load is requested by JavaScript Might load one or more modules Loaded silently (no pop-ups involved) Ideally used for pure computation Uses SFI to sandbox and secure Presented by: Gilmore R. Lundquist Native Client
Overview and Goals Architecture Implementation Extras Communication Browser to NaCl module communication subsystems IMC (Inter-Module Communications) Reliable datagram service Can be used by trusted and untrusted clients 2 protocols available, built on IMC (SRPC) Simple Remote Procedure Call Used for JavaScript calls to native code (NPAPI) Netscape Plugin Application Programming Interface Used to access browser state, open URLs, access the DOM Provides facilities normally available in JavaScript Allows: Browser content modifications, handling mouse/keyboard activity, fetching additional site content Shared memory and shared synchronization objects also available from IMC Presented by: Gilmore R. Lundquist Native Client
Overview and Goals Architecture Implementation Extras Service Runtime The service runtime provides system services common to application programming: sysbrk() mmap() malloc() / free() (or similar) POSIX threads subset with NaCl extensions Robust enough to port Intel’s Thread Building Blocks to NaCl POSIX file IO Used for communications channels Used for fetching web-based read-only content Cannot affect the local file system connect() and accept() NOT provided – can create sockets in JavaScript Presented by: Gilmore R. Lundquist Native Client
Overview and Goals Architecture Implementation Extras Trusted NaCl Services Trusted NaCl service (e.g., storage service) Installed as a browser plugin Use of syscalls prevents implementation as NaCl module Communication to and from trusted services is available through any IMC services NaCl module can use static linking to a library to encapsulate communication details Service is trusted, and therefore must assume clients are untrusted! Presented by: Gilmore R. Lundquist Native Client
Overview and Goals Architecture Implementation Extras Attack Surface Components an attacker might exploit: Inner sandbox: Binary validation Outer sandbox: OS system-call interception Service runtime binary module loader Service runtime trampoline interfaces IMC communications interface NPAPI interface Presented by: Gilmore R. Lundquist Native Client
Overview and Goals Architecture Implementation Extras Outline Overview and Goals 1 Architecture 2 Organization NaCl Modules Communication Service Runtime Trusted NaCl Services Attack Surface Implementation 3 Sandboxing SFI / Inner Sandbox Validator Validator Performance Memory Layout Trampolines Springboard Extras 4 Presented by: Gilmore R. Lundquist Native Client
Overview and Goals Architecture Implementation Extras Sandboxing NaCl provides inner and outer sandboxes The outer sandbox is very similar to systrace or Janus (not described in paper) The inner sandbox: Is x86-specific Uses static analysis (taken from proof-carrying code techniques) Disallows Self-modifying code Arbitrary instructions Presented by: Gilmore R. Lundquist Native Client
Recommend
More recommend
