Improving browser security

35

Improving browser security ☶ browsers openbsd security marc.info
via fcbsd 3 years ago | cached | 7 comments

7

New project to create a W or X JIT engine for browsers.

3

zzing 3 years ago | link

Because it is light on specifics, how would one do a W^X JIT engine?
1. 10
  tedu 3 years ago | link
  Very briefly:
  
  mprotect(ptr, PROT_WRITE); *ptr = code; mprotect(ptr, PROT_EXEC); (*ptr)();
2. 2
  
  icefall 3 years ago | link
  
  https://bugzilla.mozilla.org/show_bug.cgi?id=677272
2

apg 3 years ago | link

@tedu what browser are you going to be working on?
1. 3
  
  tedu 3 years ago | link
  
  Not entirely decided. The objective is to accomplish what can be done, without necessarily getting bogged down in one spot.
2
cnst 3 years ago | link
So, W^X means that any given area of memory is either writable, or executable, but not both. That part seems simple enough.

However, what does it mean that the policy is only “advisory”? Can someone explain what W^X means in practical terms? As a user, is there a way to enable it “better”, like we do with malloc.conf(5)?

Is it basically only enforced for kernel map, as http://bxr.su/OpenBSD/sys/uvm/uvm_map.c#uvm_map_protect (which gets called from http://bxr.su/OpenBSD/sys/uvm/uvm_mmap.c#sys_mprotect) seems to suggest:
```
3061        if (map == kernel_map &&
3062            (new_prot & (PROT_WRITE | PROT_EXEC)) == (PROT_WRITE | PROT_EXEC))
3063            panic("uvm_map_protect: kernel map W^X violation requested\n");
```
Where do you look to see if the advisories have been violated? mprotect(1) seems rather silent on these matters.

These protections will still have to be disabled for other JIT software like emacs, correct? Will it be possible to enable/disable these protections only for certain apps? Is it currently disabled for all apps outside of the kernel space?
1. 7
  tedu 3 years ago | link
  Well, for instance, one can run:
  
  sudo procmap -p `pgrep firefox` | grep write/exec 00001068947EE000 64K read/write/exec [ anon ] 000010689FA8A000 64K read/write/exec [ anon ] 00001068B5883000 64K read/write/exec [ anon ] 00001068FB43E000 64K read/write/exec [ anon ] 0000106912BBF000 64K read/write/exec [ anon ] 0000106913B06000 64K read/write/exec [ anon ] 0000106922BCF000 64K read/write/exec [ anon ] 0000106925ED3000 64K read/write/exec [ anon ] 000010692E8E3000 64K read/write/exec [ anon ] 0000106965C60000 64K read/write/exec [ anon ] 0000106975C3B000 64K read/write/exec [ anon ] 000010698D84E000 64K read/write/exec [ anon ]