4 ms·

Disclosure: I work at Google Cloud. Can you say more about the assumed security model here? We built gVisor [1] (and historically used nacl or ptrace) precisel

by boulos 8y ago

Disclosure: I work at Google Cloud. Can you say more about the assumed security model here? We built gVisor [1] (and historically used nacl or ptrace) precisely because things like Isolates aren't (historically?!) trustworthy enough for side-by-side. Plus the whole V8-only ;). Edit: But let me say, I still think this is awesome (and love seeing more people jumping into the "just run code" space). [1] https://cloud.google.com/blog/products/gcp/open-sourcing-gvisor-a-sandboxed-container-runtime https://cloud.google.com/blog/products/gcp/open-sourcing-gvi...

kodablah 8y ago
Why aren't they trustworthy side-by-side? Due to lack of OS layers between them thereby making a cross-context vuln require only one step? Or inability to govern/throttle their resource use? In some instances in Chrome, aren't v8 context boundaries the only security between two scripts in the same process (though I know many second level domains get their own process, I don't remember what causes them to be shared)?
- 7373737373 8y ago
  I would be very interested in an answer concerning resource accounting/control. It is possible to meter .wasm processes by transpiling their source to call an external metering function every time a code block is entered: https://github.com/ewasm/wasm-metering https://github.com/ewasm/wasm-metering I have not seen something like this demonstrated in a Javascript/high-level-language context yet.
- amscanne 8y ago
  An address space provides some hardware isolation. Even if you ignore side channels, there's a lot that can go wrong in the software only case. I'm pretty sure that site isolation as a feature predated Meltdown and Spectre (though the default changed).
kentonv 8y ago
Hi, tech lead of Workers here. This is tricky to answer concisely because we've implemented a huge number and variety of defense-in-depth measures. (Plus, I'm in transit right now and can't type much -- maybe I'll edit to add more details later.) First, we believe Chrome has done a pretty good job hardening V8 over the years, and we get a lot of comfort knowing there's a $15,000 bug bounty for V8 breakouts. We update V8 continuously, tracking the version shipping in Chrome. That said, we obviously don't simply rely on V8 for everything. We've modeled what a V8 breakout is likely to look like, and added a variety of mitigations. Presumably, a V8 breakout bug is likely to allow an attacker to run arbitrary native code within the Workers runtime process. That's bad, but they will quickly run into some barriers to weaponizing this. For example, we obviously run with ASLR, so an attacker looking for other isolate's data would be flying blind and would likely raise segfaults. Any segfaults in production raise an alert and are investigated. Similarly, we run a tight seccomp fitler that denies all filesystem and network access, and if an attacker ever tries to invoke such syscalls, it will raise an alert and be investigated. It's worth noting that we do not allow eval() (or any other mechanism of "code generation from strings"), hence all code we execute has to have been uploaded through our code deployment pipeline. This implies we have a copy of all code. When a segfault raises an alert, we immediately look at the code that caused it. Anyone using a zero-day against us is very likely to burn their zero-day long before they manage to pull off a useful attack. You're probably also wondering about Spectre. Here's a previous comment of mine on that topic: https://news.ycombinator.com/item?id=18280156 https://news.ycombinator.com/item?id=18280156 Again, this is just a couple of the things we're doing... there's really too much to list in a HN comment. I hope to find time to write this up more formally in the future. :)
- jamescostian 8y ago
  > we do not allow eval() (or any other mechanism of "code generation from strings") This is interesting, because preventing code generation from strings goes beyond `eval()` and `new Function()` - it also includes things like the output www.jsfuck.com can produce (which can indirectly call things like `eval()` and `new Function()` without ever mentioning `eval` or `new Function` in their source). How do you prevent things like that?
sturadnidge 8y ago
I’m not sure gVisor was incepted because Isolates didn’t provide strong enough isolation - wasn’t it because Google was looking for a way to provide stronger isolation for containers (i.e. not V8-only) without the overhead of traditional virtualization? That is, totally different use case... going with V8-only in return for some better non-functional metrics is a trade off Cloudflare made for a serverless platform, but not one that Google (or anyone else, probably) would make for a container-based platform?

by boulos 8y ago

kodablah 8y ago

Why aren't they trustworthy side-by-side? Due to lack of OS layers between them thereby making a cross-context vuln require only one step? Or inability to govern/throttle their resource use? In some instances in Chrome, aren't v8 context boundaries the only security between two scripts in the same process (though I know many second level domains get their own process, I don't remember what causes them to be shared)?

7373737373 8y ago
I would be very interested in an answer concerning resource accounting/control. It is possible to meter .wasm processes by transpiling their source to call an external metering function every time a code block is entered: https://github.com/ewasm/wasm-metering https://github.com/ewasm/wasm-metering I have not seen something like this demonstrated in a Javascript/high-level-language context yet.
amscanne 8y ago
An address space provides some hardware isolation. Even if you ignore side channels, there's a lot that can go wrong in the software only case. I'm pretty sure that site isolation as a feature predated Meltdown and Spectre (though the default changed).

kentonv 8y ago

Hi, tech lead of Workers here. This is tricky to answer concisely because we've implemented a huge number and variety of defense-in-depth measures. (Plus, I'm in transit right now and can't type much -- maybe I'll edit to add more details later.) First, we believe Chrome has done a pretty good job hardening V8 over the years, and we get a lot of comfort knowing there's a $15,000 bug bounty for V8 breakouts. We update V8 continuously, tracking the version shipping in Chrome. That said, we obviously don't simply rely on V8 for everything. We've modeled what a V8 breakout is likely to look like, and added a variety of mitigations. Presumably, a V8 breakout bug is likely to allow an attacker to run arbitrary native code within the Workers runtime process. That's bad, but they will quickly run into some barriers to weaponizing this. For example, we obviously run with ASLR, so an attacker looking for other isolate's data would be flying blind and would likely raise segfaults. Any segfaults in production raise an alert and are investigated. Similarly, we run a tight seccomp fitler that denies all filesystem and network access, and if an attacker ever tries to invoke such syscalls, it will raise an alert and be investigated. It's worth noting that we do not allow eval() (or any other mechanism of "code generation from strings"), hence all code we execute has to have been uploaded through our code deployment pipeline. This implies we have a copy of all code. When a segfault raises an alert, we immediately look at the code that caused it. Anyone using a zero-day against us is very likely to burn their zero-day long before they manage to pull off a useful attack. You're probably also wondering about Spectre. Here's a previous comment of mine on that topic: https://news.ycombinator.com/item?id=18280156 https://news.ycombinator.com/item?id=18280156 Again, this is just a couple of the things we're doing... there's really too much to list in a HN comment. I hope to find time to write this up more formally in the future. :)

jamescostian 8y ago
> we do not allow eval() (or any other mechanism of "code generation from strings") This is interesting, because preventing code generation from strings goes beyond `eval()` and `new Function()` - it also includes things like the output www.jsfuck.com can produce (which can indirectly call things like `eval()` and `new Function()` without ever mentioning `eval` or `new Function` in their source). How do you prevent things like that?

sturadnidge 8y ago

I’m not sure gVisor was incepted because Isolates didn’t provide strong enough isolation - wasn’t it because Google was looking for a way to provide stronger isolation for containers (i.e. not V8-only) without the overhead of traditional virtualization? That is, totally different use case... going with V8-only in return for some better non-functional metrics is a trade off Cloudflare made for a serverless platform, but not one that Google (or anyone else, probably) would make for a container-based platform?