bennet yee, david sehr, gregory dardyk, j. bradley chen, robert muth, tavis ormandy, shiki okasaka,...

Native Client: A Sandbox for Portable, Untrusted x86 Native Code

Bennet Yee, David Sehr, Gregory Dardyk, J. Bradley Chen, Robert Muth, Tavis Ormandy, Shiki Okasaka, Neha Narula, and Nicholas Fullagar

Google Inc.2009 IEEE Symposium on Security and Privacy

Advanced Defense Lab

2

OUTLINE

Introduction System Architecture Implementation Experience Discussion Related Work


3

INTRODUCTION

The modern web browser brings together a remarkable combination of resources. JavaScript Document Object Model (DOM) …

It remains handicapped in a critical dimension: computational performance. Newtonian physics High-resolution scene rendering …


4

WEB BROWSER EXTENSION

Internet Explorer ActiveX

Other Browser NPAPI

Rely on non-technical measures for security


5

SYSTEM ARCHITECTURE

<embed src=“game.nexe”>

game.nexe

Service runtime

IMCBrowser

Storage

Server


6

SYSTEM ARCHITECTURE (CONT.)

Use “NaCl module” to refer to untrusted native code

The service is responsible for insuring that it only services request consistent with the implied contract with the user.


7

SANDBOX

Native Client is built around an x86-specific intra-process “inner sandbox”

A “outer sandbox ” mediates system calls at the process boundary.


8

INNER SANDBOX

Use static analysis to detect security defects

The inner sandbox is used to create a security subdomain within a native operating system process.


9

RUNTIME FACILITIES

The “Inter-Module Communications(IMC)” allows trusted and untrusted modules to send/receive datagrams with optional “NaCl Resource Descriptors.”

Two higher-level abstractions RPC NPAPI


10

RUNTIME FACILITIES (CONT.)

The service runtime provide a set of system service. Ex: mmap(), malloc()/free() A subset of the POSIX threads interface

To prevent unintended network access, connect()/accept() are omitted. Modules can access the network via

Javascript


11

IMPLEMENTATION – INNER SANDBOX

The design is limited to explicit control flow.

Allow for a small trusted code base(TCB)

Validator: less than 600 C statements About 6000 bytes of executable code


12

INNER SANDBOX - GOAL

Data integrity Use segment register(C1)

Reliable disassembly No unsafe instruction Control flow integrity


13

INNER SANDBOX - CONSTRAINT


14

INNER SANDBOX

Disallowed opcode Privileged instructions syscall and int Instructions that modify x86 segment state

lds, far calls ret – replace by indirect jump

Use hlt to terminate module(C4)


15

INNER SANDBOX

Use 32-byte alignment to avoid arbitrary x86 machine code(C5, C7)

Use nacljmp for indirect jump(C3) and %eax, 0xffffffe0 jmp *%eax


16

eip

eip


17


18

EXCEPOTIONS

Hardware exceptions and external interrupts are not allowed The incompatible models in Linux, MacOS,

and Windows. NaCl apply a failsafe policy to exceptions But NaCl support C++ exceptions


19

SERVICE RUNTIME4KB

64KB

256MBText (C2)

Trampoline / Springboard

For service runtime


20

TRAMPOLINE AND SPRINGBOARD

0x1000

0x1010

0x1020

Trampoline

Springboard

Service Runtime

Transfer to untrusted codePOSIX threadStart the main thread

0xffff


21

SYSTEM CALL OVERHEAD

The getpid syscall time is 138ns

Platform “null” ServiceRuntime call time

Linux, Ubuntu 6.06IntelTM CoreTM 2 66002.4 GHz

156

Mac OSX 10.5IntelTM XeonTM E54622.8 GHz

148

Windows XPIntelTM CoreTM 2 Q66002.4 GHz

123


22

COMMUNICATION

IMC is built around a NaCl socket, providing a bi-directional, reliable, in-order datagram service.

JavaScript can connect to the module by opening and sharing NaCl sockets as NaCl descriptors.


23

COMMUNICATION (CONT.)


24

DEVELOPER TOOLS - BUILDING

Modify gcc -falign-functions to 32-byte aligned -falign-jumps to jumped target aligned Ensure call instructions always appear in

the final byte of a 32 byte block. (for springboard)

Making some changes permits testing applications by running them on the command line.


25

EXPERIENCE

In this paper, measurements are made without the NaCl outer sandbox.


26

EXPERIENCE – SPEC2000

Average: 5%


27


About the alignment


28


About code size


29

EXPERIENCE – COMPUTE/GRAPHICS

Earth Voronoi Life


30


31

EXPERIENCE –PORTING EFFORT

H.264 Decoder Original: 11K lines of C Porting effort:

20 lines of C Rewriting the Makefile


32

EXPERIENCE –BULLET

A physics simulation system.

Baseline : 36.5 sec 32-byte aligned : 36.1 sec NaCl : 37.1 sec


33

EXPERIENCE –QUAKE


34


35

DISCUSSION

Popular operating systems generally require all threads to use a flat addressing model in order to deliver exceptions correctly.

Native Client would benefit from more consistent enabling of LDT access across popular x86 OS.


36

RELATED WORK

System Request Moderation Android

Each application is run as a different Linux user Xax by Microsoft Research

Using system call interception


37

RELATED WORK (CONT.)

Fault Isolation The current CFI technique builds on the

seminal work by Wahbe et al. CFI provides finer-gained control flow

integrity Overhead: 15% vs. 5% by NaCl


38

RELATED WORK (CONT.)

Trust with Authentication ActiveX

bennet yee, david sehr, gregory dardyk, j. bradley chen, robert muth, tavis ormandy, shiki okasaka,...

Documents