Confirmed users
717
edits
Security/ProcessIsolation: Difference between revisions
→Roadmap
| (2 intermediate revisions by the same user not shown) | |||
| Line 1: | Line 1: | ||
Process isolation is designed to separate Firefox into multiple processes, each with the least amount of privilege necessary. In doing so, the potential damage for a large number of Firefox vulnerabilities can be reduced. | Process isolation is designed to separate Firefox into multiple processes, each with the least amount of privilege necessary. In doing so, the potential damage for a large number of Firefox vulnerabilities can be reduced. | ||
| Line 6: | Line 4: | ||
Reduce the damage for various types of vulnerabilities within Firefox. This is a defense in depth measure. | Reduce the damage for various types of vulnerabilities within Firefox. This is a defense in depth measure. | ||
We will do so by: | |||
* identifying high level of categories of threats that we could address via process isolation | |||
* determining the architectural implications of mitigating each category | |||
* selecting a threat model and architecture that will address it, and prototyping it | |||
* determining whether the chosen model is actually feasible within the current Gecko architecture | |||
* implementation roadmap | |||
* implement it | |||
== Roadmap == | == Roadmap == | ||
* Put together a team of people willing to put in a sustained effort on process isolation design and prototyping (6+ month timeframe) | * Put together a team of people willing to put in a sustained effort on process isolation design and prototyping (6+ month timeframe) | ||
* Identify broad sets of vulnerabilities that might be mitigated by process isolation (high level threat model | * Identify broad sets of vulnerabilities that might be mitigated by process isolation (high level threat model, here: [[Security/ProcessIsolation/ThreatModel]] | ||
* Identify several potential architectures. A few that come to mind, there will be more: | * Identify several potential architectures. A few that come to mind, there will be more: | ||
** Isolate entire Firefox process into low rights mode (sensitive I/O virtualized or brokered). Protects system from browser vulns but does not improve stability or inter-domain security. | ** Isolate entire Firefox process into low rights mode (sensitive I/O virtualized or brokered). Protects system from browser vulns but does not improve stability or inter-domain security. | ||