Thiago Marcos P. Santos Intel Corporationcdn.download.tizen.org/misc/media/conference2013/slides/TDC2013... · Thiago Marcos P. Santos Intel Corporation. 2 example.com Images source:

Hardening WebKit2

Thiago Marcos P. SantosIntel Corporation

2

example.com

Images source: Wikimedia.org

3

example.com


4

example.com


5

Trademarks and logos belong to their respective owners.Images source: Wikimedia.org

6

Trademarks and logos belong to their respective owners.

Web

Kit2

7


Linux

8


Tizen

9


UIProcess WebProcess

IPC

10

UIProcess

WebProcess

IPC


11

UIProcess

WebProcess

NetworkProcess

IPC IPC


12

WebProcess


13

WebProcess


14

WebProcess


15

WebProcess


BrokerProcess

IPC

$HOME/.browser/example.com/* (rw)$HOME/.browser/defaults.conf (r)/usr/share/fonts/* (r)/* (not allowed)Images source: Wikimedia.org

16

Seccomp Filters

● Linux Kernel 3.5● Ubuntu 12.04● Whitelist syscalls● Blacklist syscalls● Trap syscalls and inspect its parameters● Make it possible to emulate a syscall● ~370 syscalls: libseccomp for the rescue

17

// Load seccomp filters // Load website

fd = open(path) write(fd, data) // IO close(fd) unlink(path) free(pointer)

WebProcess


// Receive serialized // syscalls

// Execute if allowed

// Send back results

BrokerProcess

IPC


18

Additional information

● Performance implications● open() ~28x slower● 15.000 open()'s in ~590ms

● Source code# ls Source/WebKit2/Shared/linux/SeccompFilters/*

● How to build# ./Tools/Scripts/build-webkit --efl -2 --seccomp-filters

● Documentationhttp://tinyurl.com/seccompwk2

Questions?

21


IPC

Web

Kit


22


IPC

Chrom

ium


VirtualPlatform


23


IPC


Web

Kit

24


IPC


Chrom

ium

Documents

Thiago Marcos P. Santos Intel Corporationcdn.download.tizen.org/misc/media/conference2013/slides/TDC2013... · Thiago Marcos P. Santos Intel Corporation. 2 example.com Images source: