4 ms·

They couldn't have made the client stub interface more baroque if they tried. It sounded like something that could mimic something approaching the original libr

They couldn't have made the client stub interface more baroque if they tried. It sounded like something that could mimic something approaching the original library interface automatically, pretty disappointed it's basically just another RPC stubs generator If you can stomach the perf tradeoffs, compiling to WASM is much easier than this

asdfasgasdgasdg 5y ago
> They couldn't have made the client stub interface more baroque if they tried. I've never used this API but the cross process synchronization stuff seems like a difficult nut to crack. I'm curious which bits you think are unnecessarily baroque. > If you can stomach the perf tradeoffs, compiling to WASM is much easier than this I'm not super familiar with WASM, but it's unclear to me how compiling to that target addresses the problems that are addressed by this system? Does WASM have built-in security policies and sandboxing? Is it easy to call into a WASM-compiled library from your native C/C++ program? How?
- codetrotter 5y ago
  > Does WASM have built-in security policies and sandboxing? Yes, WebAssembly is sandboxed. https://webassembly.org/docs/security/ https://webassembly.org/docs/security/
noja 5y ago
> If you can stomach the perf tradeoffs, compiling to WASM is much easier than this This WASM? https://www.theregister.com/2021/11/04/webassembly_stack_canaries/ https://www.theregister.com/2021/11/04/webassembly_stack_can...
- feanaro 5y ago
  Those are not sandbox escapes, those are missing intra-program defences which make it easier for a e.g. buffer overflow to be used for program manipulation. That still doesn't allow you to escape the sandbox in itself.
  - pjmlp 5y ago
    Not being able to escape the sandbox is meaningless if data corruption makes an exploit possible.
    - feanaro 5y ago
      How is it meaningless? Your program's integrity is compromised, but the host is not. That's a meaningful difference.
      - pjmlp 5y ago
        Not when an exploit is made possible thanks to integrity being compromised. The castle walls stand, yet everything burns thanks being able to turn a candle into the table.
  - aseipp 5y ago
    They don't let you perform sandbox escapes but that doesn't necessarily matter if all of the important data is inside the sandbox, and it has enough capabilities to meaningfully exfiltrate. seccomp has this problem in spades; most apps that "use seccomp" make practically every syscall under the sun available to make the policy apply cleanly. This is just an example not to be taken as totally illustrative. But very few people design their programs around seccomp or another sandbox mechanism, I find. This doesn't apply obviously to cases where you design around having a sandbox, and at that point, I think the differences between something like WASM and SAPI or whatever are a lot murkier and more technical. One thing about WASM that I feel is worth mentioning, which isn't technical so much as social, is that there's a lot of appeal/interest around simply "lift-and-shift" existing native code onto webassembly runtimes. That's good because that existing code is useful, but those apps aren't often designed with such sandbox architectures in mind. They often are designed (or at least consider) having binary-level mitigations applied, though. So I think this natural overlap in the set of use cases people have is what might give people pause. This is similar to the seccomp problem; retrofitting is a very big appeal even though it has some conceptual issues. This isn't some kind of indictment but if you're going to do an honest evaluation of these approaches I feel this background is worth keeping in mind. I think if you designed an app with a sandbox architecture by default the best sandbox is the one you trust, WASM vs whatever be damned.
ithkuil 5y ago
Is it? The doc claims that it's "almost identical" > The Sandboxed API project (SAPI) aims to make sandboxing of C/C++ libraries less burdensome: after initial setup of security policies and generation of library interfaces, an almost-identical stub API is generated (using a template-based programming variable hierarchy system), transparently forwarding calls using a custom RPC layer to the real library running inside a sandboxed environment. Are you claiming that this documentation is misleading?
- steerablesafe 5y ago
  Here is an example for sandboxing zlib: https://github.com/google/sandboxed-api/blob/main/sandboxed_api/examples/zlib/main_zlib.cc https://github.com/google/sandboxed-api/blob/main/sandboxed_... So it adds extra state, that needs to be initialized, adds extra failure points than needed to be handled in the code (sandbox initialization can fail, the RPC layer can fail itself), need to wrap some data structures so they can be passed through (you can't just pass pointers as-is). I wonder how callbacks can be passed, but maybe that's actually less problematic than data pointers.
  - nly 5y ago
    To be honest it seems like writing a capnproto rpc around the functionality you want to sandbox, and running it as a low privilege microservice, would be better than SAPI. capnproto supports passing callacks/interfaces back via its capabilities mechanism.
    - ithkuil 5y ago
      but you'd have to manually define such an rpc wrapper IDL, right? IIUC the interesting trick behind SAPI is that it generates the wrapper for you based on parsing the library public API. Perhaps I misunderstood something.
jagrsw 5y ago
Hi, one of the project's co-authors here (SAPI that is). The aim of SAPI is a bit different than whole-process sandboxing. It's about retaining the original running speed (and lack of sandboxing constraints) of the main project part, while making sure that only some parts are isolated (sandboxed), and the programming interfaces to the sandboxed parts still look familiar. I'm not that well-versed into how WASM works when it tries to integrate with the rest of OS. But I'd assume it's some form of whole-process sandboxing, where practically all code is WASMized, and only some kind of loaders and trusted stubs are written in native assemblers (something has to invoke syscalls in the end). In this case one can use Sandbox2, which is part of SAPI, though not very prominently exposed - https://github.com/google/sandboxed-api/tree/main/sandboxed_api/sandbox2 https://github.com/google/sandboxed-api/tree/main/sandboxed_.... It's a full-featured Linux sandbox in its own rights, with C++ API. Examples might be englightning: https://github.com/google/sandboxed-api/tree/main/sandboxed_api/sandbox2/examples https://github.com/google/sandboxed-api/tree/main/sandboxed_...
- oscargrouch 5y ago
  Is this the same one that is in use by Chrome? Any plans to create more sandboxes like this for other platforms like Windows and Mac?
  - jagrsw 5y ago
    > Is this the same one that is in use by Chrome? Not the same software, but "almost" the same underlying tech is used (e.g. SAPI/Sandbox2 used ptrace for process tracking and debugging, and to my knowledge Chrome Linux sandboxes don't). > Any plans to create more sandboxes like this for other platforms like Windows and Mac? Linux is so far a priority, but it might be technically possible to make the actual software isolation layer modularized, so it would support various underlying tech (various OSes, or even different tech under a single OS).
- kleton 5y ago
  Is this intended to replace older Google App Engine sandboxes, nacl and gvisor?

asdfasgasdgasdg 5y ago

> They couldn't have made the client stub interface more baroque if they tried. I've never used this API but the cross process synchronization stuff seems like a difficult nut to crack. I'm curious which bits you think are unnecessarily baroque. > If you can stomach the perf tradeoffs, compiling to WASM is much easier than this I'm not super familiar with WASM, but it's unclear to me how compiling to that target addresses the problems that are addressed by this system? Does WASM have built-in security policies and sandboxing? Is it easy to call into a WASM-compiled library from your native C/C++ program? How?

codetrotter 5y ago
> Does WASM have built-in security policies and sandboxing? Yes, WebAssembly is sandboxed. https://webassembly.org/docs/security/ https://webassembly.org/docs/security/

noja 5y ago

> If you can stomach the perf tradeoffs, compiling to WASM is much easier than this This WASM? https://www.theregister.com/2021/11/04/webassembly_stack_canaries/ https://www.theregister.com/2021/11/04/webassembly_stack_can...

feanaro 5y ago
Those are not sandbox escapes, those are missing intra-program defences which make it easier for a e.g. buffer overflow to be used for program manipulation. That still doesn't allow you to escape the sandbox in itself.
- pjmlp 5y ago
  Not being able to escape the sandbox is meaningless if data corruption makes an exploit possible.
  - feanaro 5y ago
    How is it meaningless? Your program's integrity is compromised, but the host is not. That's a meaningful difference.
    - pjmlp 5y ago
      Not when an exploit is made possible thanks to integrity being compromised. The castle walls stand, yet everything burns thanks being able to turn a candle into the table.
- aseipp 5y ago
  They don't let you perform sandbox escapes but that doesn't necessarily matter if all of the important data is inside the sandbox, and it has enough capabilities to meaningfully exfiltrate. seccomp has this problem in spades; most apps that "use seccomp" make practically every syscall under the sun available to make the policy apply cleanly. This is just an example not to be taken as totally illustrative. But very few people design their programs around seccomp or another sandbox mechanism, I find. This doesn't apply obviously to cases where you design around having a sandbox, and at that point, I think the differences between something like WASM and SAPI or whatever are a lot murkier and more technical. One thing about WASM that I feel is worth mentioning, which isn't technical so much as social, is that there's a lot of appeal/interest around simply "lift-and-shift" existing native code onto webassembly runtimes. That's good because that existing code is useful, but those apps aren't often designed with such sandbox architectures in mind. They often are designed (or at least consider) having binary-level mitigations applied, though. So I think this natural overlap in the set of use cases people have is what might give people pause. This is similar to the seccomp problem; retrofitting is a very big appeal even though it has some conceptual issues. This isn't some kind of indictment but if you're going to do an honest evaluation of these approaches I feel this background is worth keeping in mind. I think if you designed an app with a sandbox architecture by default the best sandbox is the one you trust, WASM vs whatever be damned.

ithkuil 5y ago

Is it? The doc claims that it's "almost identical" > The Sandboxed API project (SAPI) aims to make sandboxing of C/C++ libraries less burdensome: after initial setup of security policies and generation of library interfaces, an almost-identical stub API is generated (using a template-based programming variable hierarchy system), transparently forwarding calls using a custom RPC layer to the real library running inside a sandboxed environment. Are you claiming that this documentation is misleading?

steerablesafe 5y ago
Here is an example for sandboxing zlib: https://github.com/google/sandboxed-api/blob/main/sandboxed_api/examples/zlib/main_zlib.cc https://github.com/google/sandboxed-api/blob/main/sandboxed_... So it adds extra state, that needs to be initialized, adds extra failure points than needed to be handled in the code (sandbox initialization can fail, the RPC layer can fail itself), need to wrap some data structures so they can be passed through (you can't just pass pointers as-is). I wonder how callbacks can be passed, but maybe that's actually less problematic than data pointers.
- nly 5y ago
  To be honest it seems like writing a capnproto rpc around the functionality you want to sandbox, and running it as a low privilege microservice, would be better than SAPI. capnproto supports passing callacks/interfaces back via its capabilities mechanism.
  - ithkuil 5y ago
    but you'd have to manually define such an rpc wrapper IDL, right? IIUC the interesting trick behind SAPI is that it generates the wrapper for you based on parsing the library public API. Perhaps I misunderstood something.

jagrsw 5y ago

Hi, one of the project's co-authors here (SAPI that is). The aim of SAPI is a bit different than whole-process sandboxing. It's about retaining the original running speed (and lack of sandboxing constraints) of the main project part, while making sure that only some parts are isolated (sandboxed), and the programming interfaces to the sandboxed parts still look familiar. I'm not that well-versed into how WASM works when it tries to integrate with the rest of OS. But I'd assume it's some form of whole-process sandboxing, where practically all code is WASMized, and only some kind of loaders and trusted stubs are written in native assemblers (something has to invoke syscalls in the end). In this case one can use Sandbox2, which is part of SAPI, though not very prominently exposed - https://github.com/google/sandboxed-api/tree/main/sandboxed_api/sandbox2 https://github.com/google/sandboxed-api/tree/main/sandboxed_.... It's a full-featured Linux sandbox in its own rights, with C++ API. Examples might be englightning: https://github.com/google/sandboxed-api/tree/main/sandboxed_api/sandbox2/examples https://github.com/google/sandboxed-api/tree/main/sandboxed_...

oscargrouch 5y ago
Is this the same one that is in use by Chrome? Any plans to create more sandboxes like this for other platforms like Windows and Mac?
- jagrsw 5y ago
  > Is this the same one that is in use by Chrome? Not the same software, but "almost" the same underlying tech is used (e.g. SAPI/Sandbox2 used ptrace for process tracking and debugging, and to my knowledge Chrome Linux sandboxes don't). > Any plans to create more sandboxes like this for other platforms like Windows and Mac? Linux is so far a priority, but it might be technically possible to make the actual software isolation layer modularized, so it would support various underlying tech (various OSes, or even different tech under a single OS).
kleton 5y ago
Is this intended to replace older Google App Engine sandboxes, nacl and gvisor?