{"id":71650,"date":"2020-02-27T08:51:33","date_gmt":"2020-02-27T05:51:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/mozilla-nachinaet-vnedrenie-tehnologii-izolyaczii-bibliotek-rlbox"},"modified":"2020-03-03T16:10:40","modified_gmt":"2020-03-03T13:10:40","slug":"mozilla-nachinaet-vnedrenie-tehnologii-izolyaczii-bibliotek-rlbox","status":"publish","type":"post","link":"https:\/\/prohoster.info\/et\/blog\/news\/mozilla-nachinaet-vnedrenie-tehnologii-izolyaczii-bibliotek-rlbox","title":{"rendered":"Mozilla alustab RLBoxi raamatukogude isolatsiooni tehnoloogia rakendamist","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Stanford \u00dclikooli, San Diegos asuva California \u00dclikooli ja Austini Texas \u00dclikooli teadlased on arendanud<\/a><\/noindex> t\u00f6\u00f6riistakomplekt RLBox<\/a><\/noindex>, mis v\u00f5ib toimida t\u00e4iendava isoleerimise tasandina, et blokeerida haavatavusi funktsioonide raamatukogudes. RLBox keskendub mittev\u00f5rgu k\u00f5rvaliste teekide turvaprobleemi lahendamisele, mis ei ole arendajate kontrolli all, kuid mille haavatavused v\u00f5ivad ohustada p\u00f5hiprojekti. <\/p>\n

Ettev\u00f5te Mozilla plaanib<\/a><\/noindex> rakendada RLBox Linuxi versioonides Firefox 74 ja macOS versioonides Firefox 75, et isoleerida teegi t\u00e4itmine Graphite<\/a><\/noindex>, mis vastutab fondide joonistamise eest. RLBox ei ole Firefoxile spetsiifiline ja seda saab kasutada igasuguste teekide isoleerimiseks erinevates projektides. Arendused<\/a><\/noindex> RLBox levitatakse<\/a><\/noindex> MIT litsentsi alusel. Praegu toetab RLBox Linuxi ja macOS platvorme, Windowsi tugi on ootel.<\/p>\n

Mehhanism<\/a><\/noindex> RLBox'i t\u00f6\u00f6 seisneb C\/C++ koodi isolatsiooni teegi kompileerimises madalama taseme vahefailikoodiks WebAssembly, mis seej\u00e4rel vormistatakse WebAssembly moodulina, mille \u00f5igused on m\u00e4\u00e4ratud ainult sellele moodulile (n\u00e4iteks stringide t\u00f6\u00f6tlemise teek ei saa avada v\u00f5rgusokke ega faile). C\/C++ koodi muundamine WebAssembly'ks toimub wasi-sdk<\/a><\/noindex>. <\/p>\n

Kohese t\u00e4itmise jaoks kompileeritakse WebAssembly moodul masina koodiks kompilatori Lucet<\/a><\/noindex> \u0438 \u0432\u044b\u043f\u043e\u043b\u043d\u044f\u0435\u0442\u0441\u044f \u0432 \u043e\u0442\u0434\u0435\u043b\u044c\u043d\u043e\u043c «\u043d\u0430\u043d\u043e\u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0435», \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u043e\u0442 \u043e\u0441\u0442\u0430\u043b\u044c\u043d\u043e\u0439 \u043f\u0430\u043c\u044f\u0442\u0438 \u043f\u0440\u0438\u043b\u043e\u0436\u0435\u043d\u0438\u044f. \u041a\u043e\u043c\u043f\u0438\u043b\u044f\u0442\u043e\u0440 Lucet \u043e\u0441\u043d\u043e\u0432\u0430\u043d \u043d\u0430 \u0442\u043e\u043c \u0436\u0435 \u043a\u043e\u0434\u0435, \u0447\u0442\u043e \u0438 JIT-\u0434\u0432\u0438\u0436\u043e\u043a Cranelift<\/a><\/noindex>, mida kasutatakse Firefoxis WebAssembly t\u00e4itmiseks. <\/p>\n

Kogutud moodul t\u00f6\u00f6tab eraldi m\u00e4lu piirkonnas ja ei p\u00e4\u00e4se juurde \u00fclej\u00e4\u00e4nud aadressiruumile. Raamatukogu haavatavuse \u00e4rakasutamisel on r\u00fcndajal piiratud juurdep\u00e4\u00e4s ning ta ei saa p\u00f6\u00f6rduda p\u00f5hiprotsessi m\u00e4lu alade ega edastada juhtimist v\u00e4ljapoole isoleeritud keskkonda. <\/p>\n

\"Mozilla<\/a><\/noindex><\/center><\/p>\n

Arendajatele on pakutud k\u00f5rgetasemeline API<\/a><\/noindex>, mis v\u00f5imaldab kutsuda raamatukogu funktsioone isoleeritud re\u017eiimis. WebAssembly' t\u00f6\u00f6tlejad vajavad peaaegu \u00fcldse t\u00e4iendavaid ressursse ja suhtlemine nendega ei ole oluliselt aeglasem kui tavaliste funktsioonide kutsumine (raamatukogu funktsioonid t\u00e4idetakse natiivse koodina ning lisakulud tekivad ainult andmete kopeerimise ja kontrollimise k\u00e4igus isoleeritud keskkonnaga suhtlemisel). Isoleeritud raamatukogu funktsioone ei saa otseselt kutsuda ning nendele juurdep\u00e4\u00e4suks on vajalik rakendada
\n vahekihti invoke_sandbox_function(). <\/p>\n

Omakorda, kui raamatukogust on vaja v\u00e4liseid funktsioone kutsuda, peavad need funktsioonid olema selgelt m\u00e4\u00e4ratletud meetodi register_callback abil (eelnevalt RLBox v\u00f5imaldab juurdep\u00e4\u00e4su funktsioonidele standardsest raamatukogust<\/a><\/noindex>). M\u00e4lu ohutu toimimise tagamiseks (memory safety) ei piisa koodi t\u00e4itmise isoleerimisest ja on vajalik ka tagada tagastatud andmevoogude kontrollimine.<\/p>\n

Isoleeritud keskkonnas genereeritud v\u00e4\u00e4rtused m\u00e4rgistatakse kui usaldamatud, neid piiratakse tainted-siltidega<\/a><\/noindex> \u0438 \u0434\u043b\u044f «\u043e\u0447\u0438\u0441\u0442\u043a\u0438» \u0442\u0440\u0435\u0431\u0443\u044e\u0442 kontrollimine<\/a><\/noindex> ja kopeerimine rakenduse m\u00e4llu.
\n\u0411\u0435\u0437 \u043e\u0447\u0438\u0441\u0442\u043a\u0438, \u043f\u043e\u043f\u044b\u0442\u043a\u0430 \u0438\u0441\u043f\u043e\u043b\u044c\u0437\u043e\u0432\u0430\u043d\u0438\u044f tainted-\u0434\u0430\u043d\u043d\u044b\u0445 \u0432 \u043a\u043e\u043d\u0442\u0435\u043a\u0441\u0442\u0435, \u0442\u0440\u0435\u0431\u0443\u044e\u0449\u0435\u043c \u043e\u0431\u044b\u0447\u043d\u044b\u0445 \u0434\u0430\u043d\u043d\u044b\u0445 (\u0438 \u043d\u0430\u043e\u0431\u043e\u0440\u043e\u0442) \u043f\u0440\u0438\u0432\u043e\u0434\u0438\u0442 \u043a \u0433\u0435\u043d\u0435\u0440\u0430\u0446\u0438\u0438 \u043e\u0448\u0438\u0431\u043e\u043a \u043d\u0430 \u044d\u0442\u0430\u043f\u0435 \u043a\u043e\u043c\u043f\u0438\u043b\u044f\u0446\u0438\u0438. \u041d\u0435\u0431\u043e\u043b\u044c\u0448\u0438\u0435 \u0430\u0440\u0433\u0443\u043c\u0435\u043d\u0442\u044b \u0444\u0443\u043d\u043a\u0446\u0438\u0439, \u0432\u043e\u0437\u0432\u0440\u0430\u0449\u0430\u0435\u043c\u044b\u0435 \u0437\u043d\u0430\u0447\u0435\u043d\u0438\u044f \u0438 \u0441\u0442\u0440\u0443\u043a\u0442\u0443\u0440\u044b \u043f\u0435\u0440\u0435\u0434\u0430\u044e\u0442\u0441\u044f \u0447\u0435\u0440\u0435\u0437 \u043a\u043e\u043f\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u0435 \u043c\u0435\u0436\u0434\u0443 \u043f\u0430\u043c\u044f\u0442\u044c\u044e \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0430 \u0438 \u043f\u0430\u043c\u044f\u0442\u044c\u044e \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u0433\u043e \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u044f. \u0414\u043b\u044f \u0431\u043e\u043b\u044c\u0448\u0438\u0445 \u043d\u0430\u0431\u043e\u0440\u043e\u0432 \u0434\u0430\u043d\u043d\u044b\u0445 \u043f\u0430\u043c\u044f\u0442\u044c \u0432\u044b\u0434\u0435\u043b\u044f\u0435\u0442\u0441\u044f \u0432 \u0438\u0437\u043e\u043b\u0438\u0440\u043e\u0432\u0430\u043d\u043d\u043e\u043c \u043e\u043a\u0440\u0443\u0436\u0435\u043d\u0438\u0438, \u0430 \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u043c\u0443 \u043f\u0440\u043e\u0446\u0435\u0441\u0441\u0443 \u0432\u043e\u0437\u0432\u0440\u0430\u0449\u0430\u0435\u0442\u0441\u044f \u043f\u0440\u044f\u043c\u043e\u0439 \u0443\u043a\u0430\u0437\u0430\u0442\u0435\u043b\u044c «sandbox-reference». <\/p>\n

<\/a><\/noindex><\/p>\n

Allikas: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0421\u0442\u0435\u043d\u0434\u0444\u043e\u0440\u0434\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430, \u041a\u0430\u043b\u0438\u0444\u043e\u0440\u043d\u0438\u0439\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u0421\u0430\u043d-\u0414\u0438\u0435\u0433\u043e \u0438 \u0422\u0435\u0445\u0430\u0441\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u041e\u0441\u0442\u0438\u043d\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 RLBox, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c\u0441\u044f \u043a\u0430\u043a \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 \u0444\u0443\u043d\u043a\u0446\u0438\u0439. RLBox \u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u043d\u0435\u0437\u0430\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u0434\u043e\u0432\u0435\u0440\u0438\u044f \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0435 \u043f\u043e\u0434\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u043d\u044b \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c, \u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u043e\u0433\u0443\u0442 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u043f\u0440\u043e\u0435\u043a\u0442. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043f\u043b\u0430\u043d\u0438\u0440\u0443\u0435\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":71651,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-71650","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mozilla alustab RLBox raamatukogude isoleerimise tehnoloogia rakendamist | ProHoster","description":"Stanford \u00dclikooli, San Diegos asuva California \u00dclikooli ja Austini Texas \u00dclikooli teadlased","canonical_url":"https:\/\/prohoster.info\/et\/blog\/news\/mozilla-nachinaet-vnedrenie-tehnologii-izolyaczii-bibliotek-rlbox","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"et_EE","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Mozilla \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a RLBox | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0421\u0442\u0435\u043d\u0434\u0444\u043e\u0440\u0434\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430, \u041a\u0430\u043b\u0438\u0444\u043e\u0440\u043d\u0438\u0439\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u0421\u0430\u043d-\u0414\u0438\u0435\u0433\u043e \u0438 \u0422\u0435\u0445\u0430\u0441\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u041e\u0441\u0442\u0438\u043d\u0435","og:url":"https:\/\/prohoster.info\/et\/blog\/news\/mozilla-nachinaet-vnedrenie-tehnologii-izolyaczii-bibliotek-rlbox","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-27T05:51:33+00:00","article:modified_time":"2020-03-03T13:10:40+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"71650","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:32:42","updated":"2022-09-29 09:11:36","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/71650","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/comments?post=71650"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/posts\/71650\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media\/71651"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/media?parent=71650"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/categories?post=71650"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/et\/wp-json\/wp\/v2\/tags?post=71650"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}