Re: Electrolysis security

On 8/14/09 7:27 PM, Lucas Adamski wrote:

>  c) plugins/NPAPI may have odd behavior when in a separate process from
> chrome

This worries me primarily because we have only the most bare-bones set of
tests for plugins (I found recently that we seem to have no tests at all for
the behavior of NPStreams, for example. Do you know of external NPAPI test
suites that we could use, or tests that plugin vendors would be willing to
contribute to our codebase?

>  a) routing all network access through parent process

Being worked-on... we need this without security isolation.

>  b) how/when can remote tabs access cookies, password manager,
> certificate information, file system access for file upload/download

Well, they will definitely have to have access to read and write cookies and
probably passwords for pages loaded in their own domain... and because this
includes iframes, it's pretty trivial (at least without the newfandled CSP
stuff) for a process to be granted access to any domain's cookie/password
data simply by loading it in an iframe.

File upload/download is easier to control: Chromium presents the file upload
dialog from the parent process and only grants access to files which have
been selected in the dialog, which sounds reasonable to me.

>  d) preventing impersonation of chrome dialogs by a remote process (to
> the degree feasible)

I don't think this has much to do with Electrolysis: it's a UI and API
design issue which can be accomplished independently of multi-process
issues. From an enginerring perspective I think Electrolysis ought not to
change our behavior in any way, to avoid unnecessary risk in an already huge
project.

>  e) cache - who determines origin of documents, who writes to cache?

You mean the network cache? That is managed entirely by the chrome process
when it's doing network access, and should be basically transparent to the
content process.

> A larger threat model is located at
> https://wiki.mozilla.org/Security/ProcessIsolation/ThreatModel.  Though
> it is focused on security improvements from process isolation, it should
> still provide useful information for laying the foundation for future
> phases.

It seems that this is a summary of the threat model for browsers in general.
You don't expect that a multi-process architecture will address most of
those threats, correct?

--BDS