{"id":71650,"date":"2020-02-27T08:51:33","date_gmt":"2020-02-27T05:51:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/mozilla-nachinaet-vnedrenie-tehnologii-izolyaczii-bibliotek-rlbox"},"modified":"2020-03-03T16:10:40","modified_gmt":"2020-03-03T13:10:40","slug":"mozilla-nachinaet-vnedrenie-tehnologii-izolyaczii-bibliotek-rlbox","status":"publish","type":"post","link":"https:\/\/prohoster.info\/cs\/blog\/news\/mozilla-nachinaet-vnedrenie-tehnologii-izolyaczii-bibliotek-rlbox","title":{"rendered":"Mozilla zah\u00e1jila implementaci technologie izolace knihoven RLBox","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V\u00fdzkumn\u00edci ze Stanfordsk\u00e9 univerzity, Kalifornsk\u00e9 univerzity v San Diegu a Texask\u00e9 univerzity v Austinu vyvinuli<\/a><\/noindex> n\u00e1stroje RLBox<\/a><\/noindex>, kter\u00fd m\u016f\u017ee slou\u017eit jako dal\u0161\u00ed \u00farove\u0148 izolace pro blokov\u00e1n\u00ed zranitelnost\u00ed v funk\u010dn\u00edch knihovn\u00e1ch. RLBox je zam\u011b\u0159en na \u0159e\u0161en\u00ed probl\u00e9mu s bezpe\u010dnost\u00ed ned\u016fv\u011bryhodn\u00fdch t\u0159et\u00edch stran knihoven, kter\u00e9 nem\u00e1 pod kontrolou v\u00fdvoj\u00e1\u0159, ale jejich zranitelnosti mohou ohrozit hlavn\u00ed projekt. <\/p>\n

Spole\u010dnost Mozilla pl\u00e1nuje<\/a><\/noindex> pou\u017e\u00edt RLBox v linuxov\u00fdch verz\u00edch Firefoxu 74 a macOS verz\u00edch Firefoxu 75 pro izolaci prov\u00e1d\u011bn\u00ed knihovny Graphite<\/a><\/noindex>, kter\u00e1 se star\u00e1 o vykreslov\u00e1n\u00ed p\u00edsem. RLBox nen\u00ed specifick\u00fd pro Firefox a m\u016f\u017ee b\u00fdt pou\u017eit pro izolaci jak\u00fdchkoli knihoven v libovoln\u00fdch projektech. V\u00fdsledky<\/a><\/noindex> RLBox se distribuj\u00ed<\/a><\/noindex> pod licenc\u00ed MIT. V sou\u010dasnosti RLBox podporuje pr\u00e1ci na platform\u00e1ch Linux a macOS, podpora Windows se o\u010dek\u00e1v\u00e1 pozd\u011bji.<\/p>\n

Mechanismus<\/a><\/noindex> funkce RLBox spo\u010d\u00edv\u00e1 v kompilaci k\u00f3du C\/C++ z isolovan\u00e9 knihovny do n\u00edzko\u00farov\u0148ov\u00e9ho mezik\u00f3du WebAssembly, kter\u00fd je n\u00e1sledn\u011b zabaleno jako WebAssembly modul, jeho\u017e opr\u00e1vn\u011bn\u00ed jsou nastavena pouze na tento modul (nap\u0159\u00edklad knihovna pro zpracov\u00e1n\u00ed \u0159et\u011bzc\u016f nebude moci otev\u0159\u00edt s\u00ed\u0165ov\u00fd socket nebo soubor). P\u0159evod k\u00f3du C\/C++ na WebAssembly se prov\u00e1d\u00ed pomoc\u00ed wasi-sdk<\/a><\/noindex>. <\/p>\n

Pro p\u0159\u00edm\u00e9 prov\u00e1d\u011bn\u00ed se modul WebAssembly kompiluje do strojov\u00e9ho k\u00f3du pomoc\u00ed kompil\u00e1toru Lucet<\/a><\/noindex> a prov\u00e1d\u00ed se v samostatn\u00e9m <nanoprocesu>, izolovan\u00e9m od ostatn\u00ed pam\u011bti aplikace. Kompil\u00e1tor Lucet je zalo\u017een na stejn\u00e9m k\u00f3du, jako JIT engine Cranelift<\/a><\/noindex>, pou\u017e\u00edvan\u00fd v Firefoxu pro prov\u00e1d\u011bn\u00ed WebAssembly. <\/p>\n

Sestaven\u00fd modul pracuje v odd\u011blen\u00e9 oblasti pam\u011bti a nem\u00e1 p\u0159\u00edstup k ostatn\u00edmu adresn\u00edmu prostoru. V p\u0159\u00edpad\u011b zneu\u017eit\u00ed zranitelnosti v knihovn\u011b bude \u00fato\u010dn\u00edk omezen a nebude m\u00edt mo\u017enost p\u0159istupovat k oblastem pam\u011bti hlavn\u00edho procesu nebo p\u0159edat \u0159\u00edzen\u00ed mimo izolovan\u00e9 prost\u0159ed\u00ed. <\/p>\n

\"Mozilla<\/a><\/noindex><\/center><\/p>\n

V\u00fdvoj\u00e1\u0159\u016fm je nab\u00edzena vysok\u00e1 \u00farove\u0148 API<\/a><\/noindex>, kter\u00fd umo\u017e\u0148uje vol\u00e1n\u00ed funkc\u00ed knihovny v izolovan\u00e9m re\u017eimu. WebAssembly zpracovatele t\u00e9m\u011b\u0159 nevy\u017eaduj\u00ed dal\u0161\u00ed zdroje a interakce s nimi nen\u00ed mnohem pomalej\u0161\u00ed ne\u017e vol\u00e1n\u00ed b\u011b\u017en\u00fdch funkc\u00ed (funkce knihovny se prov\u00e1d\u011bj\u00ed ve form\u011b nativn\u00edho k\u00f3du a n\u00e1klady vznikaj\u00ed pouze p\u0159i kop\u00edrov\u00e1n\u00ed a kontrole dat b\u011bhem interakce s izolovan\u00fdm prost\u0159ed\u00edm). Funkce izolovan\u00e9 knihovny nelze volat p\u0159\u00edmo a pro jejich vyvol\u00e1n\u00ed je nutn\u00e9 pou\u017e\u00edt
\n vrstvu invoke_sandbox_function(). <\/p>\n

Na opl\u00e1tku, pokud je z knihovny pot\u0159eba volat extern\u00ed funkce, tyto funkce mus\u00ed b\u00fdt explicitn\u011b definov\u00e1ny pomoc\u00ed metody register_callback (ve v\u00fdchoz\u00edm nastaven\u00ed RLBox poskytuje p\u0159\u00edstup k funkc\u00edm standardn\u00ed knihovny<\/a><\/noindex>). Pro zaji\u0161t\u011bn\u00ed bezpe\u010dn\u00e9 pr\u00e1ce s pam\u011bt\u00ed (memory safety) izolace prov\u00e1d\u011bn\u00ed k\u00f3du nesta\u010d\u00ed a je tak\u00e9 nutn\u00e9 zajistit kontrolu vracen\u00fdch datov\u00fdch tok\u016f.<\/p>\n

Hodnoty vytvo\u0159en\u00e9 v izolovan\u00e9m prost\u0159ed\u00ed jsou ozna\u010dov\u00e1ny jako ned\u016fv\u011bryhodn\u00e9, jsou omezeny pomoc\u00ed tainted-\u0161t\u00edtk\u016f<\/a><\/noindex> a pro <\u010di\u0161t\u011bn\u00ed> vy\u017eaduj\u00ed verifikaci<\/a><\/noindex> a kop\u00edrov\u00e1n\u00ed do pam\u011bti aplikace.
\nBez \u010di\u0161t\u011bn\u00ed, pokus o pou\u017eit\u00ed zne\u010di\u0161t\u011bn\u00fdch dat v kontextu, kter\u00fd vy\u017eaduje b\u011b\u017en\u00e1 data (a naopak), vede k vygenerov\u00e1n\u00ed chyb b\u011bhem kompilace. Mal\u00e9 argumenty funkc\u00ed, vracen\u00e9 hodnoty a struktury se p\u0159ed\u00e1vaj\u00ed kop\u00edrov\u00e1n\u00edm mezi procesn\u00ed pam\u011bt\u00ed a pam\u011bt\u00ed izolovan\u00e9ho prost\u0159ed\u00ed. Pro v\u011bt\u0161\u00ed datov\u00e9 sady je pam\u011b\u0165 alokov\u00e1na v izolovan\u00e9m prost\u0159ed\u00ed, zat\u00edmco hlavn\u00edmu procesu se vrac\u00ed p\u0159\u00edm\u00fd ukazatel <sandbox-reference>. <\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0421\u0442\u0435\u043d\u0434\u0444\u043e\u0440\u0434\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430, \u041a\u0430\u043b\u0438\u0444\u043e\u0440\u043d\u0438\u0439\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u0421\u0430\u043d-\u0414\u0438\u0435\u0433\u043e \u0438 \u0422\u0435\u0445\u0430\u0441\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u041e\u0441\u0442\u0438\u043d\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 RLBox, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c\u0441\u044f \u043a\u0430\u043a \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 \u0444\u0443\u043d\u043a\u0446\u0438\u0439. RLBox \u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u043d\u0435\u0437\u0430\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u0434\u043e\u0432\u0435\u0440\u0438\u044f \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0435 \u043f\u043e\u0434\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u043d\u044b \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c, \u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u043e\u0433\u0443\u0442 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u043f\u0440\u043e\u0435\u043a\u0442. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043f\u043b\u0430\u043d\u0438\u0440\u0443\u0435\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":71651,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-71650","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mozilla za\u010d\u00edn\u00e1 zav\u00e1d\u011bt technologii izolace knihoven RLBox | ProHoster","description":"V\u00fdzkumn\u00edci ze Stanfordsk\u00e9 univerzity, Kalifornsk\u00e9 univerzity v San Diegu a Texask\u00e9 univerzity v Austinu","canonical_url":"https:\/\/prohoster.info\/cs\/blog\/news\/mozilla-nachinaet-vnedrenie-tehnologii-izolyaczii-bibliotek-rlbox","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"cs_CZ","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Mozilla \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a RLBox | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0421\u0442\u0435\u043d\u0434\u0444\u043e\u0440\u0434\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430, \u041a\u0430\u043b\u0438\u0444\u043e\u0440\u043d\u0438\u0439\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u0421\u0430\u043d-\u0414\u0438\u0435\u0433\u043e \u0438 \u0422\u0435\u0445\u0430\u0441\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u041e\u0441\u0442\u0438\u043d\u0435","og:url":"https:\/\/prohoster.info\/cs\/blog\/news\/mozilla-nachinaet-vnedrenie-tehnologii-izolyaczii-bibliotek-rlbox","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-27T05:51:33+00:00","article:modified_time":"2020-03-03T13:10:40+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"71650","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:32:42","updated":"2022-09-29 09:11:36","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/71650","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/comments?post=71650"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/posts\/71650\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media\/71651"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/media?parent=71650"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/categories?post=71650"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/cs\/wp-json\/wp\/v2\/tags?post=71650"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}