{"id":71650,"date":"2020-02-27T08:51:33","date_gmt":"2020-02-27T05:51:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/mozilla-nachinaet-vnedrenie-tehnologii-izolyaczii-bibliotek-rlbox"},"modified":"2020-03-03T16:10:40","modified_gmt":"2020-03-03T13:10:40","slug":"mozilla-nachinaet-vnedrenie-tehnologii-izolyaczii-bibliotek-rlbox","status":"publish","type":"post","link":"https:\/\/prohoster.info\/da\/blog\/news\/mozilla-nachinaet-vnedrenie-tehnologii-izolyaczii-bibliotek-rlbox","title":{"rendered":"Mozilla starter implementeringen af RLBox-biblioteksisoleringsteknologi.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Forskere fra Stanford University, University of California San Diego og University of Texas i Austin har udviklet<\/a><\/noindex> v\u00e6rkt\u00f8jer RLBox<\/a><\/noindex>, som kan anvendes som et ekstra isoleringsniveau for at blokere s\u00e5rbarheder i funktionsbiblioteker. RLBox sigter mod at l\u00f8se problemet med usikre tredjepartsbiblioteker, som ikke er under kontrol af udviklerne, men hvor s\u00e5rbarheder kan kompromittere hovedprojektet. <\/p>\n

Mozilla Company at foretage \u00e6ndringer for at give udvikleren mulighed for at v\u00e6lge navnet p\u00e5 den f\u00f8rste gren ved oprettelsen af et nyt repository. N\u00e5r kommandoen \u00abgit init\u00bb udf\u00f8res, oprettes som standard en gren kaldet \u00abmaster\u00bb. Det f\u00f8rste skridt vil v\u00e6re at tilf\u00f8je en indstilling til at \u00e6ndre navnet p\u00e5 hovedgrenen for de oprettede repositorier. Git's nuv\u00e6rende standardadf\u00e6rd forbliver u\u00e6ndret, og sp\u00f8rgsm\u00e5let om at \u00e6ndre standardnavnet er stadig under diskussion, der er endnu ikke truffet nogen beslutning p\u00e5 dette omr\u00e5de.<\/a><\/noindex> implementere RLBox i Linux-udgaver af Firefox 74 og macOS-udgaver af Firefox 75 for at isolere udf\u00f8relsen af biblioteket Graphite<\/a><\/noindex>, som er ansvarlig for rendering af skrifttyper. RLBox er ikke specifik for Firefox og kan anvendes til at isolere alle biblioteker i vilk\u00e5rlige projekter. Udviklinger<\/a><\/noindex> RLBox distribueres<\/a><\/noindex> under MIT-licensen. I \u00f8jeblikket underst\u00f8tter RLBox drift p\u00e5 Linux- og macOS-platforme, mens Windows-support forventes senere.<\/p>\n

Mekanisme<\/a><\/noindex> RLBox's funktionalitet reduceres til at kompilere C\/C++-koden fra det isolerede bibliotek til lavniveau WebAssembly-intermedi\u00e6r kode, som derefter pakkes som et WebAssembly-modul, hvis bef\u00f8jelser er bundet udelukkende til dette modul (for eksempel kan et bibliotek til strengebehandling ikke \u00e5bne en netv\u00e6rkssocket eller en fil). Kodekonvertering fra C\/C++ til WebAssembly udf\u00f8res ved hj\u00e6lp af wasi-sdk<\/a><\/noindex>. <\/p>\n

For direkte udf\u00f8relse kompilieres WebAssembly-modulet til maskinkode ved hj\u00e6lp af kompileringsv\u00e6rkt\u00f8jet Lucet<\/a><\/noindex> og udf\u00f8res i en separat «nanoprocess», isoleret fra den \u00f8vrige hukommelse af applikationen. Lucet-kompilatoren er baseret p\u00e5 den samme kode som JIT-motoren Cranelift<\/a><\/noindex>, der anvendes i Firefox til at udf\u00f8re WebAssembly. <\/p>\n

Det samlede modul k\u00f8rer i et separat hukommelsesomr\u00e5de og har ikke adgang til det \u00f8vrige adresseomr\u00e5de. I tilf\u00e6lde af udnyttelse af en s\u00e5rbarhed i biblioteket vil angriberen v\u00e6re begr\u00e6nset og ikke kunne f\u00e5 adgang til hukommelsesomr\u00e5derne i hovedprocessen eller overf\u00f8re styringen uden for det isolerede milj\u00f8. <\/p>\n

\"Mozilla<\/a><\/noindex><\/center><\/p>\n

Til udviklere er der givet et h\u00f8j-niveau API<\/a><\/noindex>, som g\u00f8r det muligt at kalde funktioner fra biblioteket i en isoleret tilstand. WebAssembly-h\u00e5ndterere kr\u00e6ver n\u00e6sten ingen ekstra ressourcer, og interaktionen med dem er ikke meget langsommere end kaldet til almindelige funktioner (biblioteksfunktionerne udf\u00f8res i form af sikker kode, og omkostningerne opst\u00e5r kun ved kopiering og kontrol af data i interaktionen med det isolerede milj\u00f8). Funktionerne fra det isolerede bibliotek kan ikke kaldes direkte, og for at f\u00e5 adgang til dem skal man anvende
\n mellemlaget invoke_sandbox_function(). <\/p>\n

Hvis man derimod skal kalde eksterne funktioner fra biblioteket, skal disse funktioner v\u00e6re eksplicit defineret ved hj\u00e6lp af metoden register_callback (som standard giver RLBox adgang til funktionerne fra standardbiblioteket<\/a><\/noindex>). For at sikre sikker arbejde med hukommelsen (memory safety) er udf\u00f8relsesisolering alene ikke tilstr\u00e6kkeligt, og der kr\u00e6ves ogs\u00e5 kontrol af de returnerede datastreams.<\/p>\n

V\u00e6rdier dannet i det isolerede milj\u00f8 markereres som ikke betroede, begr\u00e6nses ved hj\u00e6lp af tainted-m\u00e6rker<\/a><\/noindex> og til «rensning» kr\u00e6ver verifikation<\/a><\/noindex> og kopiering til applikationens hukommelse.
\nUden rensning vil fors\u00f8g p\u00e5 at bruge tainted-data i en sammenh\u00e6ng, der kr\u00e6ver normale data (og omvendt) f\u00f8re til fejl ved kompilering. Sm\u00e5 funktionsargumenter, returv\u00e6rdier og strukturer overf\u00f8res ved kopiering mellem proces-hukommelse og hukommelsen i det isolerede milj\u00f8. For store datam\u00e6ngder tildeles hukommelse i det isolerede milj\u00f8, mens der returneres en direkte peker «sandbox-reference» til hovedprocessen. <\/p>\n

<\/a><\/noindex><\/p>\n

Kilde: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0421\u0442\u0435\u043d\u0434\u0444\u043e\u0440\u0434\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430, \u041a\u0430\u043b\u0438\u0444\u043e\u0440\u043d\u0438\u0439\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u0421\u0430\u043d-\u0414\u0438\u0435\u0433\u043e \u0438 \u0422\u0435\u0445\u0430\u0441\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u041e\u0441\u0442\u0438\u043d\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 RLBox, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c\u0441\u044f \u043a\u0430\u043a \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 \u0444\u0443\u043d\u043a\u0446\u0438\u0439. RLBox \u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u043d\u0435\u0437\u0430\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u0434\u043e\u0432\u0435\u0440\u0438\u044f \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0435 \u043f\u043e\u0434\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u043d\u044b \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c, \u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u043e\u0433\u0443\u0442 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u043f\u0440\u043e\u0435\u043a\u0442. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043f\u043b\u0430\u043d\u0438\u0440\u0443\u0435\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":71651,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-71650","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mozilla begynder implementeringen af RLBox-biblioteksisoleringsteknologien | ProHoster","description":"Forskere fra Stanford University, University of California San Diego og University of Texas i Austin","canonical_url":"https:\/\/prohoster.info\/da\/blog\/news\/mozilla-nachinaet-vnedrenie-tehnologii-izolyaczii-bibliotek-rlbox","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"da_DK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Mozilla \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a RLBox | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0421\u0442\u0435\u043d\u0434\u0444\u043e\u0440\u0434\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430, \u041a\u0430\u043b\u0438\u0444\u043e\u0440\u043d\u0438\u0439\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u0421\u0430\u043d-\u0414\u0438\u0435\u0433\u043e \u0438 \u0422\u0435\u0445\u0430\u0441\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u041e\u0441\u0442\u0438\u043d\u0435","og:url":"https:\/\/prohoster.info\/da\/blog\/news\/mozilla-nachinaet-vnedrenie-tehnologii-izolyaczii-bibliotek-rlbox","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-27T05:51:33+00:00","article:modified_time":"2020-03-03T13:10:40+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"71650","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:32:42","updated":"2022-09-29 09:11:36","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/71650","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/comments?post=71650"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/posts\/71650\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media\/71651"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/media?parent=71650"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/categories?post=71650"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/da\/wp-json\/wp\/v2\/tags?post=71650"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}