57 ms·

Cool. Wasn’t aware of CHERI, but was thinking about a “CHERI light” that would use the regular x86/arm MMU to enforce some compartmentalization within programs

Cool. Wasn’t aware of CHERI, but was thinking about a “CHERI light” that would use the regular x86/arm MMU to enforce some compartmentalization within programs the other day. Anybody know if there is such a project?

pornel 2y ago
Not exactly the same, but Mozilla had a whacky idea of compiling C to WASM and then WASM back to native code, which gives a natively running program that is sandboxing its own memory accesses: https://hacks.mozilla.org/2020/02/securing-firefox-with-webassembly/ https://hacks.mozilla.org/2020/02/securing-firefox-with-weba...
astrange 2y ago
There are some kinds of heap isolation worth doing, eg some mentioned in https://www.synacktiv.com/sites/default/files/2022-10/attacking_safari_in_2022_slides.pdf https://www.synacktiv.com/sites/default/files/2022-10/attack.... But the good ones rely on PAC (pointer signing), which comes from CHERI and x86 doesn't have it.
chc4 2y ago
Intel MPX had both hardware support for "bounds tables" and bounds checks[0], along with a "memory key" system[1] more similar to CHERI for memory tagging (only at page granularity, however). Both were massive failures and they are no longer supporting the extensions on new chips going forward. 0: https://www.kernel.org/doc/html/v5.5/x86/intel_mpx.html https://www.kernel.org/doc/html/v5.5/x86/intel_mpx.html 1: https://lwn.net/Articles/643797/ https://lwn.net/Articles/643797/
- pjmlp 2y ago
  Meanwhile Solaris Sparc is doing it since 2015, we have ongoing ARM MTE, Apple's PAC, and Microsoft with CherIoT and Pluton. Yet another example of Intel's failure to deliver.
- aseipp 2y ago
  MPX is dead, but memory protection keys are a distinct feature and work fine (with some limitations); I haven't seen anything about them being removed at all and Intel doesn't note them in their deprecated features list. AMD even added support for them in Zen3.
  - chc4 2y ago
    Oh, TIL. I was under the impression they were both removed , and didn't know AMD had it either.
convolvatron 2y ago
I worked on a prototype to add kernel-mediated segmentation to linux. its easy to associate a segment map to a thread, and manage maps in virtual addresses and provide a call gate which is a registered procedure that can change a map. making it airtight and useful in an existing programming environment is less straightforward

pornel 2y ago

Not exactly the same, but Mozilla had a whacky idea of compiling C to WASM and then WASM back to native code, which gives a natively running program that is sandboxing its own memory accesses: https://hacks.mozilla.org/2020/02/securing-firefox-with-webassembly/ https://hacks.mozilla.org/2020/02/securing-firefox-with-weba...

astrange 2y ago

There are some kinds of heap isolation worth doing, eg some mentioned in https://www.synacktiv.com/sites/default/files/2022-10/attacking_safari_in_2022_slides.pdf https://www.synacktiv.com/sites/default/files/2022-10/attack.... But the good ones rely on PAC (pointer signing), which comes from CHERI and x86 doesn't have it.

chc4 2y ago

Intel MPX had both hardware support for "bounds tables" and bounds checks[0], along with a "memory key" system[1] more similar to CHERI for memory tagging (only at page granularity, however). Both were massive failures and they are no longer supporting the extensions on new chips going forward. 0: https://www.kernel.org/doc/html/v5.5/x86/intel_mpx.html https://www.kernel.org/doc/html/v5.5/x86/intel_mpx.html 1: https://lwn.net/Articles/643797/ https://lwn.net/Articles/643797/

pjmlp 2y ago
Meanwhile Solaris Sparc is doing it since 2015, we have ongoing ARM MTE, Apple's PAC, and Microsoft with CherIoT and Pluton. Yet another example of Intel's failure to deliver.
aseipp 2y ago
MPX is dead, but memory protection keys are a distinct feature and work fine (with some limitations); I haven't seen anything about them being removed at all and Intel doesn't note them in their deprecated features list. AMD even added support for them in Zen3.
- chc4 2y ago
  Oh, TIL. I was under the impression they were both removed , and didn't know AMD had it either.

convolvatron 2y ago

I worked on a prototype to add kernel-mediated segmentation to linux. its easy to associate a segment map to a thread, and manage maps in virtual addresses and provide a call gate which is a registered procedure that can change a map. making it airtight and useful in an existing programming environment is less straightforward