Bennet Yee, David Sehr, Gregory Dardyk, J. Bradley Chen, Robert Muth, Tavis Ormandy, Shiki Okasaka, Neha Narula, and Nicholas Fullagar Google Inc IEEE Symposium on Security and Privacy

 Introduction  System Architecture  Implementation  Experience  Discussion  Related Work 2 Advanced Defense Lab

 The modern web browser brings together a remarkable combination of resources.  JavaScript  Document Object Model (DOM)  …  It remains handicapped in a critical dimension: computational performance.  Newtonian physics  High-resolution scene rendering  … Advanced Defense Lab 3

 Internet Explorer  ActiveX  Other Browser  NPAPI  Rely on non-technical measures for security Advanced Defense Lab 4

5 game.nexe Service runtime IMC Browser Storage Server

 Use “NaCl module” to refer to untrusted native code  The service is responsible for insuring that it only services request consistent with the implied contract with the user. Advanced Defense Lab 6

 Native Client is built around an x86-specific intra-process “inner sandbox”  A “outer sandbox ” mediates system calls at the process boundary. Advanced Defense Lab 7

 Use static analysis to detect security defects  The inner sandbox is used to create a security subdomain within a native operating system process. Advanced Defense Lab 8

 The “Inter-Module Communications(IMC)” allows trusted and untrusted modules to send/receive datagrams with optional “NaCl Resource Descriptors.”  Two higher-level abstractions  RPC  NPAPI Advanced Defense Lab 9

 The service runtime provide a set of system service.  Ex: mmap(), malloc()/free()  A subset of the POSIX threads interface  To prevent unintended network access, connect()/accept() are omitted.  Modules can access the network via Javascript Advanced Defense Lab 10

 The design is limited to explicit control flow.  Allow for a small trusted code base(TCB)  Validator: less than 600 C statements  About 6000 bytes of executable code Advanced Defense Lab 11

 Data integrity  Use segment register(C1)  Reliable disassembly  No unsafe instruction  Control flow integrity Advanced Defense Lab 12

Advanced Defense Lab 13

 Disallowed opcode  Privileged instructions  syscall and int  Instructions that modify x86 segment state  lds, far calls  ret – replace by indirect jump  Use hlt to terminate module(C4) Advanced Defense Lab 14

 Use 32-byte alignment to avoid arbitrary x86 machine code(C5, C7)  Use nacljmp for indirect jump(C3)  and %eax, 0xffffffe0  jmp *%eax Advanced Defense Lab 15

Advanced Defense Lab 16 eip

Advanced Defense Lab 17

 Hardware exceptions and external interrupts are not allowed  The incompatible models in Linux, MacOS, and Windows.  NaCl apply a failsafe policy to exceptions  But NaCl support C++ exceptions Advanced Defense Lab 18

Advanced Defense Lab 19 4KB 64KB 256MB Text (C2) Trampoline / Springboard For service runtime

Advanced Defense Lab 20 0x1000 0x1010 0x1020 Trampoline Springboard Service Runtime Transfer to untrusted code POSIX thread Start the main thread 0xffff

 The getpid syscall time is 138ns Advanced Defense Lab 21 Platform“null” Service Runtime call time Linux, Ubuntu 6.06 Intel TM Core TM GHz 156 Mac OSX 10.5 Intel TM Xeon TM E GHz 148 Windows XP Intel TM Core TM 2 Q GHz 123

 IMC is built around a NaCl socket, providing a bi-directional, reliable, in-order datagram service.  JavaScript can connect to the module by opening and sharing NaCl sockets as NaCl descriptors. Advanced Defense Lab 22

Advanced Defense Lab 23

 Modify gcc  -falign-functions to 32-byte aligned  -falign-jumps to jumped target aligned  Ensure call instructions always appear in the final byte of a 32 byte block. (for springboard)  Making some changes permits testing applications by running them on the command line. Advanced Defense Lab 24

 In this paper, measurements are made without the NaCl outer sandbox. Advanced Defense Lab 25

Advanced Defense Lab 26 Average: 5%

 About the alignment Advanced Defense Lab 27

 About code size Advanced Defense Lab 28

 Earth  Voronoi  Life Advanced Defense Lab 29

Advanced Defense Lab 30

 H.264 Decoder  Original: 11K lines of C  Porting effort:  20 lines of C  Rewriting the Makefile Advanced Defense Lab 31

 A physics simulation system.  Baseline : 36.5 sec  32-byte aligned : 36.1 sec  NaCl : 37.1 sec Advanced Defense Lab 32

Advanced Defense Lab 33

Advanced Defense Lab 34

 Popular operating systems generally require all threads to use a flat addressing model in order to deliver exceptions correctly.  Native Client would benefit from more consistent enabling of LDT access across popular x86 OS. Advanced Defense Lab 35

 System Request Moderation  Android  Each application is run as a different Linux user  Xax by Microsoft Research  Using system call interception Advanced Defense Lab 36

 Fault Isolation  The current CFI technique builds on the seminal work by Wahbe et al.  CFI provides finer-gained control flow integrity  Overhead: 15% vs. 5% by NaCl Advanced Defense Lab 37

 Trust with Authentication  ActiveX Advanced Defense Lab 38