canmove, Confirmed users
1,220
edits
Security/Sandbox/Hardening: Difference between revisions
→Hardening the Firefox Security Sandbox
Ptheriault (talk | contribs) |
Ptheriault (talk | contribs) |
||
| Line 3: | Line 3: | ||
The basis of the Firefox security sandbox model is that web content is loaded in "Content process", separate from the trusted Firefox code which runs in the "Chrome process" (also called the "parent" process). Content processes execute in a sandbox which limits the system privileges so that if a malicious web page manages exploits a vulnerability to execute arbitrary code it will be unable to compromise the underlying OS. | The basis of the Firefox security sandbox model is that web content is loaded in "Content process", separate from the trusted Firefox code which runs in the "Chrome process" (also called the "parent" process). Content processes execute in a sandbox which limits the system privileges so that if a malicious web page manages exploits a vulnerability to execute arbitrary code it will be unable to compromise the underlying OS. | ||
[[File:Sandbox Hardening.png | [[File:Sandbox Hardening.png]] | ||
The sandboxed child processes (red borders) include the content processes (web, file & extension) and several other child processes: | The sandboxed child processes (red borders) include the content processes (web, file & extension) and several other child processes: | ||
| Line 26: | Line 26: | ||
The goal of hardening is to make the browser resilient, even when a content process is compromised. Having a strong sandbox in place is no use, if a weak trust model or IPC implementation flaw leads to trivial privilege escalation: | The goal of hardening is to make the browser resilient, even when a content process is compromised. Having a strong sandbox in place is no use, if a weak trust model or IPC implementation flaw leads to trivial privilege escalation: | ||
[[File:SandboxBypass.png | [[File:SandboxBypass.png]] | ||
To harden the browser against this sort of sandbox bypass, several efforts are underway: | To harden the browser against this sort of sandbox bypass, several efforts are underway: | ||