It may seem magical, but it is very simple: From memory, native client 'safe code' means the following:<div><br></div><div>1. a subset of instructions are legal.</div><div>2. all instructions are 32-byte aligned (yes, that is 32-byte aligned - lots of nops in between)</div>
<div>3. all jumps must be to 32-byte aligned memory spaces</div><div>4. all indirect jumps must follow a pattern: something like load the address into a certain register immediately followed by a 'and' opcode to mask the low 5 bits to force the address to 32-byte alignment, immediately followed by a indirect jump. </div>
<div>5. all calls must be implemented as a push 32-byte immediate return address followed by a jump as above.</div><div>6. all systems calls must pass through an system API call which is well defined.</div><div><br></div>
<div>(I should look it up first, but the above about covers it)</div><div><br></div><div>'safe code' complies with the rules. Code that tries to leave the sandbox gets halted. Code that tries to use an invalid API call is halted. Code that tries to jump to a non-32-byte aligned instruction gets halted.</div>
<div><br></div><div>For ARM it is much simpler since all instructions are 32 bit aligned (not sure how thumb-mode is handled - my guess is that it isn't allowed).</div><div><br><br><div class="gmail_quote">On Fri, Jun 25, 2010 at 7:00 AM, Richard Pruss <span dir="ltr"><<a href="mailto:ric@cisco.com">ric@cisco.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex;"><div style="word-wrap:break-word">Yea, I have also been following this from the GoogleIO talk etc. I feel your key point 2 is seriously magical.<div>
Especially for any program of less than trivial size - think of something like AutoCad with a few million lines of code.</div><div><br><div>Earlier on this thread someone pointed out the more people a platform gets the more it becomes a target, but also the</div>
<div>more features there are on a platform or program on the target there is.</div><div><br></div><div>That said I do not want to belittle the steps they are taking forward it is very interesting stuff.</div><div><br><div>
<div><div></div><div class="h5"><div>On 24/06/2010, at 7:47 PM, phil colbourn wrote:</div><br></div></div><blockquote type="cite"><div><div></div><div class="h5"><div>I have been following Google's Chrome OS. It seems to me that they have decided to tackle the problem in a different way: by eliminating the problem of malware, vulnerabilities and buggy code.</div>
<div><br></div>
<div><br></div><div>The key points as I see it:</div><div><br></div><div>1. No app gets installed. The OS is a minimal image that has many ways to verify that it is sound. All other software is downloaded and cached. The OS itself is probably a native client app itself running on a small VM manager.</div>
<div><br></div><div>2. Strictly allow only native x86/ARM code that can be verified safe.</div><div><br></div><div>3. Run native code in a sandbox with limited access to system resources - basically none.</div><div><br></div>
<div><br></div><div>These and other measures seem to solve the hardware/software security issues. To reduce the risk of social attacks they</div><div><br></div><div>5. Actively monitor sites for malware activity and highlight in searches.</div>
<div><br></div><div>6. Increasingly encourage SSL services.</div><div><br></div><div><br></div><div>This does not solve the server issue, so they</div><div><br></div><div>7. Push Software as a Service and Platform as a Service to eliminate poorly secured servers and OSs.</div>
<div><br></div><div><br></div><div>I think this sort of approach is the future of computers and servers. It is notable that their approach does not rely on trusted compiler tool chains, signed code (except for the boot loader I think) and malware scanners.</div>
<div><br></div>-- <br>Phil<br><br><a href="http://philatwarrimoo.blogspot.com/" target="_blank">http://philatwarrimoo.blogspot.com</a><br><a href="http://code.google.com/p/snmp2xml" target="_blank">http://code.google.com/p/snmp2xml</a><br>
<br>"Someone has solved it and uploaded it for free."<br>
<br>"If I have nothing to hide, you have no reason to look."<br><br>"Any sufficiently advanced technology is indistinguishable from magic." Arthur C. Clarke - Who does magic today?<br><br></div></div>
<div class="im">
_______________________________________________<br>AusNOG mailing list<br><a href="mailto:AusNOG@lists.ausnog.net" target="_blank">AusNOG@lists.ausnog.net</a><br><a href="http://lists.ausnog.net/mailman/listinfo/ausnog" target="_blank">http://lists.ausnog.net/mailman/listinfo/ausnog</a><br>
</div></blockquote></div><br></div></div></div></blockquote></div><br><br clear="all"><br>-- <br>Phil<br><br><a href="http://philatwarrimoo.blogspot.com">http://philatwarrimoo.blogspot.com</a><br><a href="http://code.google.com/p/snmp2xml">http://code.google.com/p/snmp2xml</a><br>
<br>"Someone has solved it and uploaded it for free."<br><br>"If I have nothing to hide, you have no reason to look."<br><br>"Any sufficiently advanced technology is indistinguishable from magic." Arthur C. Clarke - Who does magic today?<br>
<br>
</div>