{"id":71650,"date":"2020-02-27T08:51:33","date_gmt":"2020-02-27T05:51:33","guid":{"rendered":"https:\/\/prohoster.info\/blog\/mozilla-nachinaet-vnedrenie-tehnologii-izolyaczii-bibliotek-rlbox"},"modified":"2020-03-03T16:10:40","modified_gmt":"2020-03-03T13:10:40","slug":"mozilla-nachinaet-vnedrenie-tehnologii-izolyaczii-bibliotek-rlbox","status":"publish","type":"post","link":"https:\/\/prohoster.info\/sk\/blog\/news\/mozilla-nachinaet-vnedrenie-tehnologii-izolyaczii-bibliotek-rlbox","title":{"rendered":"Mozilla za\u010d\u00edna zav\u00e1dza\u0165 technol\u00f3giu izol\u00e1cie kni\u017en\u00edc RLBox","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

V\u00fdskumn\u00edci zo Stanfordovej univerzity, Kalifornskej univerzity v San Diegu a Texanskej univerzity v Austine vyvinuli<\/a><\/noindex> n\u00e1stroj RLBox<\/a><\/noindex>, ktor\u00fd m\u00f4\u017ee sl\u00fa\u017ei\u0165 ako dodato\u010dn\u00e1 \u00farove\u0148 izol\u00e1cie na blokovanie zranite\u013enost\u00ed v kni\u017eniciach funkci\u00ed. RLBox je zameran\u00fd na rie\u0161enie probl\u00e9mov s bezpe\u010dnos\u0165ou nespo\u013eahliv\u00fdch extern\u00fdch kni\u017en\u00edc, ktor\u00e9 nie s\u00fa pod kontrolou v\u00fdvoj\u00e1rov, ale zranite\u013enosti v nich m\u00f4\u017eu ohrozi\u0165 hlavn\u00fd projekt. <\/p>\n

Spolo\u010dnos\u0165 Mozilla pl\u00e1nuje<\/a><\/noindex> implementova\u0165 RLBox v linuxov\u00fdch zostav\u00e1ch Firefox 74 a macOS zostav\u00e1ch Firefox 75 na izol\u00e1ciu vykon\u00e1vania kni\u017enice Graphite<\/a><\/noindex>, ktor\u00e1 je zodpovedn\u00e1 za vykres\u013eovanie p\u00edsiem. RLBox nie je \u0161pecifick\u00fd len pre Firefox a m\u00f4\u017ee sa pou\u017e\u00edva\u0165 na izol\u00e1ciu ak\u00fdchko\u013evek kni\u017en\u00edc v r\u00f4znych projektoch. V\u00fdvoj<\/a><\/noindex> RLBox s\u00fa distribuovan\u00e9<\/a><\/noindex> pod licenciou MIT. V s\u00fa\u010dasnosti RLBox podporuje fungovanie na platform\u00e1ch Linux a macOS, podpora Windows sa o\u010dak\u00e1va nesk\u00f4r.<\/p>\n

Mechanizmus<\/a><\/noindex> \u010dinnos\u0165 RLBox spo\u010d\u00edva v preklade C\/C++ k\u00f3du izolovanej kni\u017enice do n\u00edzko\u00farov\u0148ov\u00e9ho medziproduktu WebAssembly, ktor\u00fd je potom spracovan\u00fd ako WebAssembly modul, ktor\u00e9ho opr\u00e1vnenia s\u00fa obmedzen\u00e9 iba na tento modul (napr\u00edklad kni\u017enica na spracovanie re\u0165azcov nebude schopn\u00e1 otvori\u0165 sie\u0165ov\u00fd socket alebo s\u00fabor). Prevod C\/C++ k\u00f3du na WebAssembly sa realizuje pomocou wasi-sdk<\/a><\/noindex>. <\/p>\n

Na priame vykon\u00e1vanie sa WebAssembly modul preklad\u00e1 do strojov\u00e9ho k\u00f3du pomocou kompil\u00e1tora Lucet<\/a><\/noindex> a vykon\u00e1va sa v samostatnom «nanoprocesse», izolovanom od zvy\u0161ku pam\u00e4te aplik\u00e1cie. Kompil\u00e1tor Lucet je zalo\u017een\u00fd na rovnakom k\u00f3de ako JIT-motor Cranelift<\/a><\/noindex>, ktor\u00fd sa pou\u017e\u00edva v Firefoxe na vykon\u00e1vanie WebAssembly. <\/p>\n

Skompilovan\u00fd modul pracuje v oddelenom priestore pam\u00e4te a nem\u00e1 pr\u00edstup k ostatn\u00e9mu adresn\u00e9mu priestoru. V pr\u00edpade zneu\u017eitia zranite\u013enosti v kni\u017enici bude \u00fato\u010dn\u00edk obmedzen\u00fd a nebude schopn\u00fd z\u00edska\u0165 pr\u00edstup k oblastiam pam\u00e4te hlavn\u00e9ho procesu alebo prenies\u0165 riadenie mimo izolovan\u00e9ho prostredia. <\/p>\n

\"Mozilla<\/a><\/noindex><\/center><\/p>\n

Pre v\u00fdvoj\u00e1rov je poskytnut\u00e9 vysoko\u00farov\u0148ov\u00e9 API<\/a><\/noindex>, ktor\u00fd umo\u017e\u0148uje vola\u0165 funkcie kni\u017enice v izola\u010dnom re\u017eime. WebAssembly spracovatelia si takmer nevy\u017eaduj\u00fa \u010fal\u0161ie zdroje a interakcia s nimi nie je v\u00fdrazne pomal\u0161ia ne\u017e volanie be\u017en\u00fdch funkci\u00ed (funkcie kni\u017enice sa vykon\u00e1vaj\u00fa vo forme nat\u00edvneho k\u00f3du a n\u00e1klady vznikaj\u00fa iba pri kop\u00edrovan\u00ed a kontrole \u00fadajov po\u010das interakcie s izolovan\u00fdm prostred\u00edm). Funkcie izolovanej kni\u017enice nem\u00f4\u017eu by\u0165 volan\u00e9 priamo a pre ich pr\u00edstup je potrebn\u00e9 pou\u017ei\u0165
\n medzivrstvu invoke_sandbox_function(). <\/p>\n

Na druhej strane, ak je potrebn\u00e9 z kni\u017enice vola\u0165 vonkaj\u0161ie funkcie, tieto funkcie musia by\u0165 v\u00fdslovne definovan\u00e9 pomocou met\u00f3dy register_callback (pod\u013ea predvolenia RLBox poskytuje pr\u00edstup k funkci\u00e1m \u0161tandardnej kni\u017enice<\/a><\/noindex>). Na zabezpe\u010denie bezpe\u010dnej pr\u00e1ce s pam\u00e4\u0165ou (memory safety) izol\u00e1cia vykon\u00e1vania k\u00f3du nesta\u010d\u00ed a je potrebn\u00e9 zabezpe\u010di\u0165 aj kontrolu vracan\u00fdch tokov \u00fadajov.<\/p>\n

Hodnoty vytvoren\u00e9 v izolovanom prostred\u00ed s\u00fa ozna\u010den\u00e9 ako ned\u00f4veryhodn\u00e9, s\u00fa obmedzen\u00e9 pomocou tainted zna\u010diek<\/a><\/noindex> a pre «vy\u010distenie» vy\u017eaduj\u00fa verifik\u00e1ciu<\/a><\/noindex> a kop\u00edrovanie do pam\u00e4te aplik\u00e1cie.
\nBez vy\u010distenia, pokus o pou\u017eitie po\u0161koden\u00fdch d\u00e1t v kontexte, ktor\u00fd vy\u017eaduje be\u017en\u00e9 d\u00e1ta (a naopak) vedie k vzniku ch\u00fdb v priebehu kompil\u00e1cie. Mal\u00e9 argumenty funkci\u00ed, vracan\u00e9 hodnoty a \u0161trukt\u00fary sa pren\u00e1\u0161aj\u00fa cez kop\u00edrovanie medzi pam\u00e4\u0165ou procesu a pam\u00e4\u0165ou izolovan\u00e9ho prostredia. Pre ve\u013ek\u00e9 mno\u017estv\u00e1 d\u00e1t sa pam\u00e4\u0165 pride\u013euje v izolovanom prostred\u00ed a z\u00e1kladn\u00e9mu procesu sa vracia priamy ukazovate\u013e «sandbox-reference». <\/p>\n

<\/a><\/noindex><\/p>\n

Zdroj: opennet.ru<\/a><\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"

\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0421\u0442\u0435\u043d\u0434\u0444\u043e\u0440\u0434\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430, \u041a\u0430\u043b\u0438\u0444\u043e\u0440\u043d\u0438\u0439\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u0421\u0430\u043d-\u0414\u0438\u0435\u0433\u043e \u0438 \u0422\u0435\u0445\u0430\u0441\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u041e\u0441\u0442\u0438\u043d\u0435 \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0430\u043b\u0438 \u0438\u043d\u0441\u0442\u0440\u0443\u043c\u0435\u043d\u0442\u0430\u0440\u0438\u0439 RLBox, \u043a\u043e\u0442\u043e\u0440\u044b\u0439 \u043c\u043e\u0436\u0435\u0442 \u043f\u0440\u0438\u043c\u0435\u043d\u044f\u0442\u044c\u0441\u044f \u043a\u0430\u043a \u0434\u043e\u043f\u043e\u043b\u043d\u0438\u0442\u0435\u043b\u044c\u043d\u044b\u0439 \u0443\u0440\u043e\u0432\u0435\u043d\u044c \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u0434\u043b\u044f \u0431\u043b\u043e\u043a\u0438\u0440\u043e\u0432\u0430\u043d\u0438\u044f \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0435\u0439 \u0432 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a\u0430\u0445 \u0444\u0443\u043d\u043a\u0446\u0438\u0439. RLBox \u043d\u0430\u0446\u0435\u043b\u0435\u043d \u043d\u0430 \u0440\u0435\u0448\u0435\u043d\u0438\u0435 \u043f\u0440\u043e\u0431\u043b\u0435\u043c\u044b \u0441 \u0431\u0435\u0437\u043e\u043f\u0430\u0441\u043d\u043e\u0441\u0442\u044c\u044e \u043d\u0435\u0437\u0430\u0441\u043b\u0443\u0436\u0438\u0432\u0430\u044e\u0449\u0438\u0445 \u0434\u043e\u0432\u0435\u0440\u0438\u044f \u0441\u0442\u043e\u0440\u043e\u043d\u043d\u0438\u0445 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a, \u043a\u043e\u0442\u043e\u0440\u044b\u0435 \u043d\u0435 \u043f\u043e\u0434\u043a\u043e\u043d\u0442\u0440\u043e\u043b\u044c\u043d\u044b \u0440\u0430\u0437\u0440\u0430\u0431\u043e\u0442\u0447\u0438\u043a\u0430\u043c, \u043d\u043e \u0443\u044f\u0437\u0432\u0438\u043c\u043e\u0441\u0442\u0438 \u0432 \u043a\u043e\u0442\u043e\u0440\u044b\u0445 \u043c\u043e\u0433\u0443\u0442 \u0441\u043a\u043e\u043c\u043f\u0440\u043e\u043c\u0435\u0442\u0438\u0440\u043e\u0432\u0430\u0442\u044c \u043e\u0441\u043d\u043e\u0432\u043d\u043e\u0439 \u043f\u0440\u043e\u0435\u043a\u0442. \u041a\u043e\u043c\u043f\u0430\u043d\u0438\u044f Mozilla \u043f\u043b\u0430\u043d\u0438\u0440\u0443\u0435\u0442 […]<\/p>\n","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"author":1,"featured_media":71651,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[702],"tags":[],"class_list":["post-71650","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\n","aioseo_head_json":{"title":"\ud83e\udd47Mozilla za\u010dne zav\u00e1dza\u0165 technol\u00f3giu izol\u00e1cie kni\u017en\u00edc RLBox | ProHoster","description":"V\u00fdskumn\u00edci zo Stanfordovej univerzity, Kalifornskej univerzity v San Diegu a Texanskej univerzity v Austine","canonical_url":"https:\/\/prohoster.info\/sk\/blog\/news\/mozilla-nachinaet-vnedrenie-tehnologii-izolyaczii-bibliotek-rlbox","robots":"max-image-preview:large","keywords":"","webmasterTools":{"miscellaneous":""},"schema":null,"og:locale":"sk_SK","og:site_name":"ProHoster | \u041a\u0443\u043f\u0438\u0442\u044c \u043d\u0430\u0434\u0435\u0436\u043d\u044b\u0439 \u0445\u043e\u0441\u0442\u0438\u043d\u0433 \u0434\u043b\u044f \u0441\u0430\u0439\u0442\u043e\u0432 \u0441 \u0437\u0430\u0449\u0438\u0442\u043e\u0439 \u043e\u0442 DDoS, VPS VDS \u0441\u0435\u0440\u0432\u0435\u0440\u044b","og:type":"article","og:title":"\ud83e\udd47Mozilla \u043d\u0430\u0447\u0438\u043d\u0430\u0435\u0442 \u0432\u043d\u0435\u0434\u0440\u0435\u043d\u0438\u0435 \u0442\u0435\u0445\u043d\u043e\u043b\u043e\u0433\u0438\u0438 \u0438\u0437\u043e\u043b\u044f\u0446\u0438\u0438 \u0431\u0438\u0431\u043b\u0438\u043e\u0442\u0435\u043a RLBox | ProHoster","og:description":"\u0418\u0441\u0441\u043b\u0435\u0434\u043e\u0432\u0430\u0442\u0435\u043b\u0438 \u0438\u0437 \u0421\u0442\u0435\u043d\u0434\u0444\u043e\u0440\u0434\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430, \u041a\u0430\u043b\u0438\u0444\u043e\u0440\u043d\u0438\u0439\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u0421\u0430\u043d-\u0414\u0438\u0435\u0433\u043e \u0438 \u0422\u0435\u0445\u0430\u0441\u0441\u043a\u043e\u0433\u043e \u0443\u043d\u0438\u0432\u0435\u0440\u0441\u0438\u0442\u0435\u0442\u0430 \u0432 \u041e\u0441\u0442\u0438\u043d\u0435","og:url":"https:\/\/prohoster.info\/sk\/blog\/news\/mozilla-nachinaet-vnedrenie-tehnologii-izolyaczii-bibliotek-rlbox","og:image":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:secure_url":"https:\/\/prohoster.info\/wp-content\/uploads\/2021\/11\/logo-350.jpg","og:image:width":350,"og:image:height":350,"article:published_time":"2020-02-27T05:51:33+00:00","article:modified_time":"2020-03-03T13:10:40+00:00","article:publisher":"https:\/\/www.facebook.com\/prohoster","article:author":"https:\/\/www.facebook.com\/prohoster"},"aioseo_meta_data":{"post_id":"71650","title":null,"description":null,"keywords":null,"keyphrases":null,"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":null,"og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"","isEnabled":true},"graphs":[]},"schema_type":null,"schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":null,"robots_max_videopreview":null,"robots_max_imagepreview":"large","priority":null,"frequency":null,"local_seo":null,"seo_analyzer_scan_date":null,"breadcrumb_settings":null,"limit_modified_date":false,"reviewed_by":null,"ai":null,"created":"2021-02-28 18:32:42","updated":"2022-09-29 09:11:36","focus_keyword":null,"additional_keywords":null,"truseo_locale":null},"gt_translate_keys":[{"key":"link","format":"url"}],"_links":{"self":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/71650","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/comments?post=71650"}],"version-history":[{"count":0,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/posts\/71650\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media\/71651"}],"wp:attachment":[{"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/media?parent=71650"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/categories?post=71650"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/prohoster.info\/sk\/wp-json\/wp\/v2\/tags?post=71650"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}