Join GitHub today
GitHub is home to over 50 million developers working together to host and review code, manage projects, and build software together.
Sign upSplit Servo into multiple processes, and introduce simple sandboxing #4735
Conversation
and easier for IPC
Until we rewrite the resource task, we have to allow outbound network connections. This should be done soon, however.
Until we rewrite the resource task, we have to allow outbound network connections. This should be done soon, however. I'm not sure how to restrict access to specific files on the filesystem without root privileges.
highfive
commented
Jan 27, 2015
|
|
hoppipolla-critic-bot
commented
Jan 27, 2015
|
Critic review: https://critic.hoppipolla.co.uk/r/3843 This is an external review system which you may optionally use for the code review of your pull request. In order to help critic track your changes, please do not make in-place history rewrites (e.g. via |
|
Also would like to make sure that this works on Android & Gonk before merging this, as I mentioned in the weekly meeting :) |
|
Reviewed everything but the two commits implementing sandboxing, which are presumably going to https://github.com/pcwalton/gaol/. |
|
Assigning to @SimonSapin, though it looks like @pcwalton just needs to fix a few things and rebase. |
|
The code left to review is the sandbox, which I don’t really understand. Reassigning to @kmcallister. @pcwalton, could you clarify if https://github.com/pcwalton/gaol/ should be used, like Josh suggests? |
|
I think the plan is to use gaol, and I've reviewed the Linux sandbox portion of that. |
l0kod
commented
May 17, 2015
|
From the Site Isolation Summit, Chrome site isolation is evolving the process-per-site-instance to a new security model with Out-of-Process IFrames (OOPIF): protect sites from each other. |
|
This is blocked on the rustup because I want to switch to serde. |
|
I assume this is now blocked on e10s landing? |
|
Yes. I've got a redone version of this patch locally that's waiting on all
|
|
Closed in favour of #6884. |
pcwalton commentedJan 27, 2015
The sandboxing will be incomplete until the resource task is rewritten. However, it's a good start—no GPU access in the content process, for example.
Do not merge until after the Rust upgrade.
r? @jdm (overall design)
r? @kmcallister (Linux sandbox)
r? @zwarich (Mac stuff)