Re: Electrolysis security

On 8/18/09 8:47 PM, Lucas Adamski wrote:

>>> Regarding file access, could you elaborate a bit on what you mean by
>>> "only grants access to files"?   Ideally the file download process from
>>> the dialog-onwards is a parent-only process that does not involve the
>>> content process at all (other than simple progress updates).  I just
>>
>> I'm mainly concerned with file uploads. With <input type="file"> you give
>> the website access to the file data (scriptably even). The model Chromium
>> uses is similar to this:
>>
>> content process: fires event when the <input type="file"> browse
>> button is
>> clicked
>> chrome process: sees event, pops up file picker (perhaps with an
>> unspoofable
>> "Select a file to upload to www.example.com dialog text/header)
>> chrome process: after file is selected, open a file descriptor to the
>> file
>> and hand it back to the content process, thereby giving the content
>> process
>> access to the file.
>>
> 
> Doesn't the model above require file access privileges for the content
> process?  It seems like a restricted process shouldn't be able to write
> to the FS even with a valid handle as that would seem to imply low-level
> access to the underlying FS.  At minimum it seems to invite escalation

The content process would never be able to write to the FS... it may receive
a read-only handle/file descriptor which allows it to read a specific file
from the FS. Since handle-level security is the very basis for the sandbox
(duplicate handles/file descriptors into the content process is how IPC
itself is done), I don't think it makes sense to be more paranoid than
giving out a properly-scoped handle.


--BDS