thiago marcos p. santos intel...
TRANSCRIPT
![Page 1: Thiago Marcos P. Santos Intel Corporationcdn.download.tizen.org/misc/media/conference2013/slides/TDC2013... · Thiago Marcos P. Santos Intel Corporation. 2 example.com Images source:](https://reader035.vdocument.in/reader035/viewer/2022063001/5f1b1f99b875c921564925d6/html5/thumbnails/1.jpg)
Hardening WebKit2
Thiago Marcos P. SantosIntel Corporation
![Page 2: Thiago Marcos P. Santos Intel Corporationcdn.download.tizen.org/misc/media/conference2013/slides/TDC2013... · Thiago Marcos P. Santos Intel Corporation. 2 example.com Images source:](https://reader035.vdocument.in/reader035/viewer/2022063001/5f1b1f99b875c921564925d6/html5/thumbnails/2.jpg)
2
example.com
Images source: Wikimedia.org
![Page 3: Thiago Marcos P. Santos Intel Corporationcdn.download.tizen.org/misc/media/conference2013/slides/TDC2013... · Thiago Marcos P. Santos Intel Corporation. 2 example.com Images source:](https://reader035.vdocument.in/reader035/viewer/2022063001/5f1b1f99b875c921564925d6/html5/thumbnails/3.jpg)
3
example.com
Images source: Wikimedia.org
![Page 4: Thiago Marcos P. Santos Intel Corporationcdn.download.tizen.org/misc/media/conference2013/slides/TDC2013... · Thiago Marcos P. Santos Intel Corporation. 2 example.com Images source:](https://reader035.vdocument.in/reader035/viewer/2022063001/5f1b1f99b875c921564925d6/html5/thumbnails/4.jpg)
4
example.com
Images source: Wikimedia.org
![Page 5: Thiago Marcos P. Santos Intel Corporationcdn.download.tizen.org/misc/media/conference2013/slides/TDC2013... · Thiago Marcos P. Santos Intel Corporation. 2 example.com Images source:](https://reader035.vdocument.in/reader035/viewer/2022063001/5f1b1f99b875c921564925d6/html5/thumbnails/5.jpg)
5
Trademarks and logos belong to their respective owners.Images source: Wikimedia.org
![Page 6: Thiago Marcos P. Santos Intel Corporationcdn.download.tizen.org/misc/media/conference2013/slides/TDC2013... · Thiago Marcos P. Santos Intel Corporation. 2 example.com Images source:](https://reader035.vdocument.in/reader035/viewer/2022063001/5f1b1f99b875c921564925d6/html5/thumbnails/6.jpg)
6
Trademarks and logos belong to their respective owners.
Web
Kit2
![Page 7: Thiago Marcos P. Santos Intel Corporationcdn.download.tizen.org/misc/media/conference2013/slides/TDC2013... · Thiago Marcos P. Santos Intel Corporation. 2 example.com Images source:](https://reader035.vdocument.in/reader035/viewer/2022063001/5f1b1f99b875c921564925d6/html5/thumbnails/7.jpg)
7
Trademarks and logos belong to their respective owners.
Linux
![Page 8: Thiago Marcos P. Santos Intel Corporationcdn.download.tizen.org/misc/media/conference2013/slides/TDC2013... · Thiago Marcos P. Santos Intel Corporation. 2 example.com Images source:](https://reader035.vdocument.in/reader035/viewer/2022063001/5f1b1f99b875c921564925d6/html5/thumbnails/8.jpg)
8
Trademarks and logos belong to their respective owners.
Tizen
![Page 9: Thiago Marcos P. Santos Intel Corporationcdn.download.tizen.org/misc/media/conference2013/slides/TDC2013... · Thiago Marcos P. Santos Intel Corporation. 2 example.com Images source:](https://reader035.vdocument.in/reader035/viewer/2022063001/5f1b1f99b875c921564925d6/html5/thumbnails/9.jpg)
9
Images source: Wikimedia.org
UIProcess WebProcess
IPC
![Page 10: Thiago Marcos P. Santos Intel Corporationcdn.download.tizen.org/misc/media/conference2013/slides/TDC2013... · Thiago Marcos P. Santos Intel Corporation. 2 example.com Images source:](https://reader035.vdocument.in/reader035/viewer/2022063001/5f1b1f99b875c921564925d6/html5/thumbnails/10.jpg)
10
UIProcess
WebProcess
IPC
Images source: Wikimedia.org
![Page 11: Thiago Marcos P. Santos Intel Corporationcdn.download.tizen.org/misc/media/conference2013/slides/TDC2013... · Thiago Marcos P. Santos Intel Corporation. 2 example.com Images source:](https://reader035.vdocument.in/reader035/viewer/2022063001/5f1b1f99b875c921564925d6/html5/thumbnails/11.jpg)
11
UIProcess
WebProcess
NetworkProcess
IPC IPC
Images source: Wikimedia.org
![Page 12: Thiago Marcos P. Santos Intel Corporationcdn.download.tizen.org/misc/media/conference2013/slides/TDC2013... · Thiago Marcos P. Santos Intel Corporation. 2 example.com Images source:](https://reader035.vdocument.in/reader035/viewer/2022063001/5f1b1f99b875c921564925d6/html5/thumbnails/12.jpg)
12
WebProcess
Trademarks and logos belong to their respective owners.Images source: Wikimedia.org
![Page 13: Thiago Marcos P. Santos Intel Corporationcdn.download.tizen.org/misc/media/conference2013/slides/TDC2013... · Thiago Marcos P. Santos Intel Corporation. 2 example.com Images source:](https://reader035.vdocument.in/reader035/viewer/2022063001/5f1b1f99b875c921564925d6/html5/thumbnails/13.jpg)
13
WebProcess
Trademarks and logos belong to their respective owners.Images source: Wikimedia.org
![Page 14: Thiago Marcos P. Santos Intel Corporationcdn.download.tizen.org/misc/media/conference2013/slides/TDC2013... · Thiago Marcos P. Santos Intel Corporation. 2 example.com Images source:](https://reader035.vdocument.in/reader035/viewer/2022063001/5f1b1f99b875c921564925d6/html5/thumbnails/14.jpg)
14
WebProcess
Trademarks and logos belong to their respective owners.Images source: Wikimedia.org
![Page 15: Thiago Marcos P. Santos Intel Corporationcdn.download.tizen.org/misc/media/conference2013/slides/TDC2013... · Thiago Marcos P. Santos Intel Corporation. 2 example.com Images source:](https://reader035.vdocument.in/reader035/viewer/2022063001/5f1b1f99b875c921564925d6/html5/thumbnails/15.jpg)
15
WebProcess
Trademarks and logos belong to their respective owners.
BrokerProcess
IPC
$HOME/.browser/example.com/* (rw)$HOME/.browser/defaults.conf (r)/usr/share/fonts/* (r)/* (not allowed)Images source: Wikimedia.org
![Page 16: Thiago Marcos P. Santos Intel Corporationcdn.download.tizen.org/misc/media/conference2013/slides/TDC2013... · Thiago Marcos P. Santos Intel Corporation. 2 example.com Images source:](https://reader035.vdocument.in/reader035/viewer/2022063001/5f1b1f99b875c921564925d6/html5/thumbnails/16.jpg)
16
Seccomp Filters
● Linux Kernel 3.5● Ubuntu 12.04● Whitelist syscalls● Blacklist syscalls● Trap syscalls and inspect its parameters● Make it possible to emulate a syscall● ~370 syscalls: libseccomp for the rescue
![Page 17: Thiago Marcos P. Santos Intel Corporationcdn.download.tizen.org/misc/media/conference2013/slides/TDC2013... · Thiago Marcos P. Santos Intel Corporation. 2 example.com Images source:](https://reader035.vdocument.in/reader035/viewer/2022063001/5f1b1f99b875c921564925d6/html5/thumbnails/17.jpg)
17
// Load seccomp filters // Load website
fd = open(path) write(fd, data) // IO close(fd) unlink(path) free(pointer)
WebProcess
Trademarks and logos belong to their respective owners.
// Receive serialized // syscalls
// Execute if allowed
// Send back results
BrokerProcess
IPC
Images source: Wikimedia.org
![Page 18: Thiago Marcos P. Santos Intel Corporationcdn.download.tizen.org/misc/media/conference2013/slides/TDC2013... · Thiago Marcos P. Santos Intel Corporation. 2 example.com Images source:](https://reader035.vdocument.in/reader035/viewer/2022063001/5f1b1f99b875c921564925d6/html5/thumbnails/18.jpg)
18
Additional information
● Performance implications● open() ~28x slower● 15.000 open()'s in ~590ms
● Source code# ls Source/WebKit2/Shared/linux/SeccompFilters/*
● How to build# ./Tools/Scripts/build-webkit --efl -2 --seccomp-filters
● Documentationhttp://tinyurl.com/seccompwk2
![Page 19: Thiago Marcos P. Santos Intel Corporationcdn.download.tizen.org/misc/media/conference2013/slides/TDC2013... · Thiago Marcos P. Santos Intel Corporation. 2 example.com Images source:](https://reader035.vdocument.in/reader035/viewer/2022063001/5f1b1f99b875c921564925d6/html5/thumbnails/19.jpg)
Questions?
![Page 20: Thiago Marcos P. Santos Intel Corporationcdn.download.tizen.org/misc/media/conference2013/slides/TDC2013... · Thiago Marcos P. Santos Intel Corporation. 2 example.com Images source:](https://reader035.vdocument.in/reader035/viewer/2022063001/5f1b1f99b875c921564925d6/html5/thumbnails/20.jpg)
![Page 21: Thiago Marcos P. Santos Intel Corporationcdn.download.tizen.org/misc/media/conference2013/slides/TDC2013... · Thiago Marcos P. Santos Intel Corporation. 2 example.com Images source:](https://reader035.vdocument.in/reader035/viewer/2022063001/5f1b1f99b875c921564925d6/html5/thumbnails/21.jpg)
21
UIProcess WebProcess
IPC
Web
Kit
Trademarks and logos belong to their respective owners.Images source: Wikimedia.org
![Page 22: Thiago Marcos P. Santos Intel Corporationcdn.download.tizen.org/misc/media/conference2013/slides/TDC2013... · Thiago Marcos P. Santos Intel Corporation. 2 example.com Images source:](https://reader035.vdocument.in/reader035/viewer/2022063001/5f1b1f99b875c921564925d6/html5/thumbnails/22.jpg)
22
UIProcess WebProcess
IPC
Chrom
ium
Trademarks and logos belong to their respective owners.
VirtualPlatform
Images source: Wikimedia.org
![Page 23: Thiago Marcos P. Santos Intel Corporationcdn.download.tizen.org/misc/media/conference2013/slides/TDC2013... · Thiago Marcos P. Santos Intel Corporation. 2 example.com Images source:](https://reader035.vdocument.in/reader035/viewer/2022063001/5f1b1f99b875c921564925d6/html5/thumbnails/23.jpg)
23
UIProcess WebProcess
IPC
Trademarks and logos belong to their respective owners.Images source: Wikimedia.org
Web
Kit
![Page 24: Thiago Marcos P. Santos Intel Corporationcdn.download.tizen.org/misc/media/conference2013/slides/TDC2013... · Thiago Marcos P. Santos Intel Corporation. 2 example.com Images source:](https://reader035.vdocument.in/reader035/viewer/2022063001/5f1b1f99b875c921564925d6/html5/thumbnails/24.jpg)
24
UIProcess WebProcess
IPC
Trademarks and logos belong to their respective owners.Images source: Wikimedia.org
Chrom
ium