Mozilla Inotanga Kuitwa kweRLBox Library Isolation Technology

Vatsvagiri kubva kuStanford University, University of California kuSan Diego uye University of Texas kuAustin developed zvishandiso RLBox, iyo inogona kushandiswa seimwe yekuwedzera yekuzviparadzanisa layer yekuvhara kusasimba mumaraibhurari anoshanda. RLBox ine chinangwa chekugadzirisa dambudziko rekuchengetedza remaraibhurari asina kuvimbika ebato rechitatu asiri pasi pehutongi hwevagadziri, asi kusasimba kwavo kunogona kukanganisa chirongwa chikuru.

Mozilla Company zvirongwa shandisa RLBox muLinux inovaka yeFirefox 74 uye macOS inovaka yeFirefox 75 kuparadzanisa kuita raibhurari. Graphite, ine basa rekupa mafonti. Nekudaro, RLBox haina kunangana neFirefox uye inogona kushandiswa kupatsanura chero maraibhurari mumapurojekiti akasarudzika. Developments RLBox paradzira pasi peMIT rezinesi. RLBox parizvino inotsigira Linux uye macOS mapuratifomu, ane Windows rutsigiro inotarisirwa gare gare.

Mechanism Basa reRLBox rinouya pasi pakugadzira iyo C/C++ kodhi yeraibhurari yakasarudzika mune yakaderera-chikamu chepakati WebAssembly kodhi, iyo inozogadzirwa seWebAssembly module, mvumo yacho inoiswa zvine chekuita nemodule iyi (semuenzaniso, raibhurari. zvekugadzirisa tambo hazvigone kuvhura network socket kana faira) . Kushandura C/C++ kodhi kuWebAssembly kunoitwa uchishandisa wasi-sdk.

Kuti iitwe zvakananga, iyo WebAssembly module inounganidzwa kuita kodhi yemuchina uchishandisa compiler Lucet uye inomhanya mune yakaparadzana "nanoprocess" yakaparadzaniswa kubva kune yakasara yendangariro yeapp. Iyo Lucet compiler yakavakirwa pane imwecheteyo kodhi seJIT injini crane lift, inoshandiswa muFirefox kuita WebAssembly.

Iyo yakaunganidzwa module inoshanda munzvimbo yakaparadzana yekurangarira uye haina mukana kune yakasara yekero nzvimbo. Kana kusagadzikana muraibhurari kuchishandiswa, anorwisa anozoganhurirwa uye haakwanise kuwana nzvimbo dzekurangarira dzeiyo main process kana kutamisa kutonga kunze kwenzvimbo yakasarudzika.

Ruzivo rwepamusoro-soro runopiwa kune vanogadzira API, iyo inokutendera kuti ufonere mabasa eraibhurari mune yekuzviparadzanisa mode. Vabati veWebAssembly vanoda zvimwe zviwanikwa uye kudyidzana navo hakusi kunonoka kupfuura kudana mabasa akajairwa (mabasa eraibhurari anoitiswa nenzira yekodhi kodhi, uye mutengo wepamusoro unomuka chete kana uchikopa nekutarisa data panguva yekudyidzana nenzvimbo yakasarudzika). Isolated raibhurari mabasa haakwanise kunzi zvakananga uye anofanirwa kuwanikwa uchishandisa
layer invoke_sandbox_function().

Nekudaro, kana zvichidikanwa kudaidza ekunze mabasa kubva kuraibhurari, aya mabasa anofanirwa kutsanangurwa zvakajeka uchishandisa register_callback nzira (nekusarudzika, RLBox inopa mukana kune mabasa. standard library) Kuti uve nechokwadi chekuchengetedza ndangariro, kodhi yekuzviparadzanisa nevamwe haina kukwana uye inoda zvakare kutarisa yakadzoserwa data hova.

Hunhu hunogadzirwa munzvimbo yakasarudzika hunoratidzwa sehusingavimbike uye hune mashoma kushandisa mavara ane tsvina uye “kucheneswa” zvavanoda verification uye kukopa kune application memory.
Pasina kucheneswa, kuedza kushandisa data yakasvibiswa mumamiriro ezvinhu anoda nguva dzose data (uye zvinopesana) zvinoguma nezvikanganiso zvinogadzirwa panguva yekuunganidza. Diki basa nharo, kudzoka kukosha, uye zvimiro zvinopfuudzwa kuburikidza nekukopa pakati pe process memory uye sandbox memory. Kune mahombe data seti, ndangariro inopihwa munzvimbo iri yega uye yakananga sandbox-reference pointer inodzoserwa kune huru maitiro.

Source: opennet.ru