Re: Dropping permissions and sandboxing a browserplugin.

Jon Watte schreef:

> There is no protection from the point of view of the browser. Even the 
> "sandboxed" Chrome and IE versions don't really sandbox the system 
> itself from possible side effects of executing native code in a 
> particular plug-in. If there is a code-exploitable buffer overflow or 
> similar in a plug-in, then the machine will be available with the 
> permissions of whatever user is executing the web page with the plug-in. 

One thing that might possibly help there is to launch the plugin as a
separate process with lower permissions, and use IPC to communicate
with whatever you're trying to protect.

So you make a tiny plugin that is hopefully manageable to Get Right,
and then have all the real work done in another plugin that runs
outside the browser and sends commands, requests and even whole
rendered pages back to the should-not-be-crackable host.

This is pretty much what we did to "protect" Eve against Webkit crashing
or running exploits, although it's not (yet) at the level of confidence
that we want to enable flash and be sure nothing bad can happen to
the user's PC (as opposed to the game :) ).

http://www.youtube.com/watch?v=6KQJQhqHgz4


hth,
bert
_______________________________________________
Sweng-Gamedev mailing list
[email protected]
http://lists.midnightryder.com/listinfo.cgi/sweng-gamedev-midnightryder.com