3 ms·
> Each SIP is actually sealed — They can’t be modified from outside. There’s no shared memory between different SIPs, no signals, only explicit IPC. There are a
by seanalltogether 5y ago
> Each SIP is actually sealed — They can’t be modified from outside.
There’s no shared memory between different SIPs, no signals, only explicit IPC.
There are also no code modifications from within — no JIT, class loaders, dynamic libraries
So obviously this would never fly in the real world. Did they ever resolve how to make JITed code work? Maybe in separate container space that didn't have full privileges?
- pjmlp 5y agoEver heard of iOS? In any case, AOT and OS IPC cover most cases, welcome to UNIX pre-shared-objects. In any case, Midori had another approach.
- seanalltogether 5y agoAre we talking about this iOS? https://developer.apple.com/documentation/javascriptcore https://developer.apple.com/documentation/javascriptcore
- pjmlp 5y agoExactly and that JIT case is special purpose, only available to Apple themselves.
- monocasa 5y agoEven WinRT added back VirtualProtect with execute permissions after trying to ban it. And on the Xbox One and Xbox 360, they wanted to make the hypervisor enforce not making arbitrary pages executable (requiring the equivalent of VirtualProtect to provide crypto signatures), but needed an escape hatch for their back compat emulator. iOS is just willing to cut themselves off of entire classes of applications in a way that a lot of systems aren't.
- pjmlp 5y agoBecause they can allow themselves to push their way through. Adding back VirtualProtect to WinRT has hardly helped to improve its uptake. Had Microsoft played an Apple move, probably WinRT would look much better nowadays.
- pacaro 5y agoAt least in Midori, there was an escape hatch that, IIRC, was only used for the JavaScript engine, but that allowed some of the constraints to be broken.
- Rusky 5y agoAs an interesting related data point. Edge has a mode with no JIT and it might be usable for a lot of practical scenarios: https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/ https://microsoftedge.github.io/edgevr/posts/Super-Duper-Sec... Our current software is designed around a particular set of operations being the "expensive" ones. Maybe other configurations are workable too, with enough rearchitecting. For example, Singularity IPC looks like it should have about the same cost as a typical userspace dynamic library function call. (IMO the main problem with Singularity's approach is instead that it leaves everything wide open to Spectre...)