Re: Dropping permissions and sandboxing a browserplugin.

On Sat, Mar 20, 2010 at 3:26 AM, Jon Watte <[email protected]> wrote:
> There is no protection from the point of view of the browser. Even the
> "sandboxed" Chrome and IE versions don't really sandbox the system itself
> from possible side effects of executing native code in a particular plug-in.

That's true for Chrome, but not necessarily for IE.  Chrome runs
plug-ins with full user privileges because basically no plugins
written to the NPAPI (used by all non-IE browsers) can function if
their rights are restricted.  IE can run plug-ins via an ActiveX
interface with reduced rights, because they were able to convince all
the major plugin developers to write exclusively to the ActiveX
interface provided.

The developers of Chrome (and those of us working on Firefox, and
everyone else, I'm pretty sure) would love to be able to reduce the
rights of plugins, because they're the dominant source of security
vulnerabilities for users, by a significant margin.

> From what I understand, there's tons of places in the
> Win32 API where you can pass a function pointer around, and the window
> wouldn't render correctly (or respond to keys, or whatever) if you didn't
> have local user permissions at that point.

I don't know exactly what IE does, but the Chrome team has pretty
extensively documented their approach, and published the code for it,
and it does in fact keep the "renderer" child processes from running
with any such privileges.
http://dev.chromium.org/developers/design-documents/sandbox and

As a plugin developer, you could re-use their implementation to host a
tiny privileged stub, and then spawn your own sandbox to contain the
bulk of your code.  That would significantly reduce the attack surface
of your plugin code, but at significant cost in additional
development.  http://stackoverflow.com/questions/1590337/using-the-google-chrome-sandbox
has one description of someone else going with this approach.

Another option would be to use Google's Native Client project
(http://code.google.com/p/nativeclient/) to sandbox your code, but it
requires that you use a custom compiler to build it, so I'm not sure
which would be more work.

Mike
_______________________________________________
Sweng-Gamedev mailing list
[email protected]
http://lists.midnightryder.com/listinfo.cgi/sweng-gamedev-midnightryder.com