From 732903fc18effa9c48e4f68de55dae1a14b5754f Mon Sep 17 00:00:00 2001 From: "Kartik K. Agaram" Date: Sat, 25 Dec 2021 08:49:52 -0800 Subject: sandbox: record scenarios I've thought of so far --- sandboxing/README.md | 28 ++++++++++++++++++++++++---- 1 file changed, 24 insertions(+), 4 deletions(-) (limited to 'sandboxing/README.md') diff --git a/sandboxing/README.md b/sandboxing/README.md index 7e20d04..b816927 100644 --- a/sandboxing/README.md +++ b/sandboxing/README.md @@ -9,13 +9,33 @@ doesn't invoke any OS syscalls. Things to secure: * files opened (for read/write) on file system -* what gets written to files on file system + * destinations opened (for read/write) on network * `inet_tryconnect` // `socket_connect` * `inet_tryaccept` // `socket_accept` -* what gets written to network - * `socket_send`, `socket_sendto` - * `socket_recv`, `socket_recvfrom` + +It seems more difficult to control what is written to a file or socket once +it's opened. For starters let's just focus on the interfaces that convert a +string path or url to a file descriptor. + +Scenarios: + * (1) app reads system files + * (1) app sends data to a remote server + * (2) app can read from a remote server but not write (POST) + * app gains access to a remote server for a legitimate purpose, reads + sensitive data from the local system file for legitimate purpose. Now + there's nothing preventing it from exfiltrating the sensitive data to the + remote server. + - (2) solution: make it obvious in the UI that granting both permissions + allows an app to do anything. Educate people to separate apps that read + sensitive data from apps that access remote servers. + - (2) solution: map phases within an app to distinct permission sets + * (3) app wants access to system() or exec() + +Difficulty levels + 1. I have some sense of how to enforce this. + 2. Seems vaguely doable. + 3. Seems unlikely to be doable. ## Bottom up -- cgit 1.4.1-2-gfad0 b873eb32'/>
path: root/.hgtags
blob: 996f59968d976e6437715cf5e2e27a8645fea41d (plain) (tree) 
82384e3 ^

ee5ba14 ^

1b855fc ^

fe3756c ^

956113b ^

3000cad ^

5952157 ^

3d35ea9 ^

e3bb595 ^

a5379e9 ^

db9cda6 ^

1b492df ^

26c50c7 ^

6078d75 ^

6ff346b ^

d504005 ^

b39d0c5 ^

c34df2c ^

6cca399 ^

720b2ab ^

8e6eb52 ^

0c5f47e ^

82ddba8 ^

a2175cf ^

e06447e ^

760e23d ^

9996439 ^

3764ab4 ^

58e6866 ^

beac539 ^

a768ea9 ^

177ed7e ^

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32