Chrompartments: Hybrid Compartmentalisation for Web Browsers

点击翻译按钮获取中文摘要

The Chrompartments project will explore hybrid compartmentalisation for webbrowsers using Chrome as a concrete example. Browsers are systemically importantbut present a large attack surface due to their scale and complexity: they are amagnet for attackers with frequent published attacks.Chrompartments will use CHERI to split browsers into mutually distrustingcompartments, making them more resilient and performant. We will use Chrome (inthe form of its open-source variant Chromium) as the vehicle for ourexperimentation because it is the most widely used browser and it is alreadypartially compartmentalised in a way that we can build upon. Chrome tries whenpossible to split itself into process-based compartments (roughly speaking: 1process per tab; and some core components such as graphics are split intoseparate processes). However, this model is heavyweight: OS processes consumeconsiderable resources and many devices (particularly phones) quickly hit theirprocess limits, forcing the browser to merge multiple tabs in a single process;and communication between processes is painfully slow. Some security-criticalcomponents (e.g. V8, Chrome's JavaScript engine) would ideally be split out too,but resource and performance constraints make this impractical.We will use CHERI's "hybrid mode" (i.e. where both traditional width pointerscan be used alongside capabilities) to split Chrome into process-likecompartments. Most code will use traditional width pointers and will be boxedinto compartments; pure capabilities will allow us to emulate various forms ofinter-compartment communication. We hypothesise that this will lead to greaterpractical security, and require fewer changes, than the idealpure-capability-based compartmentalisation.Our overall aim is thus first to replace Chrome's process-based model with CHERIcompartments, and then break those crude compartments into finer-grainedcompartments, enhancing security without significantly affecting performance. Aswell as significant engineering, there is also important research: processesgive some guarantees (e.g. against some side-channel attacks) that CHERIcompartments do not currently give. We will explore these guarantees andreplicate them for CHERI compartments where their existence is necessary forbrowser security.After converting process-based isolation to CHERI compartmentalisation,Chrompartments will operate in two strands: V8, the JavaScript engine; and thegraphics stack. Both strands contain significant challenges: for example, thegraphics stack is currently contained within a single process no matter how manysites are using it. Understanding the right compartmentalisation points will becritical to Chrompartments' success and lead to a much greater understanding ofhow to use CHERI on large-scale systems.