NDLI: Language-independent sandboxing of just-in-time compilation and self-modifying code

Content Provider	ACM Digital Library
Author	Yee, Bennet Chen, Brad Marchenko, Petr Sehr, David Erlingsson, Úlfar Taylor, Elijah Schuff, Derek L. Ansel, Jason Biffle, Cliff L.
Abstract	When dealing with dynamic, untrusted content, such as on the Web, software behavior must be sandboxed, typically through use of a language like JavaScript. However, even for such specially-designed languages, it is difficult to ensure the safety of highly-optimized, dynamic language runtimes which, for efficiency, rely on advanced techniques such as Just-In-Time (JIT) compilation, large libraries of native-code support routines, and intricate mechanisms for multi-threading and garbage collection. Each new runtime provides a new potential attack surface and this security risk raises a barrier to the adoption of new languages for creating untrusted content. Removing this limitation, this paper introduces general mechanisms for safely and efficiently sandboxing software, such as dynamic language runtimes, that make use of advanced, low-level techniques like runtime code modification. Our language-independent sandboxing builds on Software-based Fault Isolation (SFI), a traditionally static technique. We provide a more flexible form of SFI by adding new constraints and mechanisms that allow safety to be guaranteed despite runtime code modifications. We have added our extensions to both the x86-32 and x86-64 variants of a production-quality, SFI-based sandboxing platform; on those two architectures SFI mechanisms face different challenges. We have also ported two representative language platforms to our extended sandbox: the Mono common language runtime and the V8 JavaScript engine. In detailed evaluations, we find that sandboxing slowdown varies between different benchmarks, languages, and hardware platforms. Overheads are generally moderate and they are close to zero for some important benchmark/platform combinations.
Starting Page	355
Ending Page	366
Page Count	12
File Format	PDF
ISSN	03621340 15581160
DOI	10.1145/1993316.1993540
Journal	ACM SIGPLAN Notices (SIGP)
Volume Number	46
Issue Number	6
Language	English
Publisher	Association for Computing Machinery (ACM)
Publisher Date	1983-05-01
Publisher Place	New York
Access Restriction	One Nation One Subscription (ONOS)
Subject Keyword	Just-in-time compilation Sandboxing Self-modifying code Security Software fault isolation
Content Type	Text
Resource Type	Article
Subject	Computer Graphics and Computer-Aided Design Software

Sl.	Authority	Responsibilities	Communication Details
1	Ministry of Education (GoI), Department of Higher Education	Sanctioning Authority	https://www.education.gov.in/ict-initiatives
2	Indian Institute of Technology Kharagpur	Host Institute of the Project: The host institute of the project is responsible for providing infrastructure support and hosting the project	https://www.iitkgp.ac.in
3	National Digital Library of India Office, Indian Institute of Technology Kharagpur	The administrative and infrastructural headquarters of the project	Dr. B. Sutradhar bsutra@ndl.gov.in
4	Project PI / Joint PI	Principal Investigator and Joint Principal Investigators of the project	Dr. B. Sutradhar bsutra@ndl.gov.in Prof. Saswat Chakrabarti will be added soon
5	Website/Portal (Helpdesk)	Queries regarding NDLI and its services	support@ndl.gov.in
6	Contents and Copyright Issues	Queries related to content curation and copyright issues	content@ndl.gov.in
7	National Digital Library of India Club (NDLI Club)	Queries related to NDLI Club formation, support, user awareness program, seminar/symposium, collaboration, social media, promotion, and outreach	clubsupport@ndl.gov.in
8	Digital Preservation Centre (DPC)	Assistance with digitizing and archiving copyright-free printed books	dpc@ndl.gov.in
9	IDR Setup or Support	Queries related to establishment and support of Institutional Digital Repository (IDR) and IDR workshops	idr@ndl.gov.in

Language-independent sandboxing of just-in-time compilation and self-modifying code

Language-independent sandboxing of just-in-time compilation and self-modifying code.

Verified just-in-time compiler on x86

Templates-based portable just-in-time compiler

Certified self-modifying code

Optimizing direct threaded code by selective inlining

Functional programming is not self-modifying code

Tracing vs. partial evaluation: comparing meta-compilation approaches for self-optimizing interpreters

Using hpm-sampling to drive dynamic compilation

Language-independent sandboxing of just-in-time compilation and self-modifying code

Similar Documents

Language-independent sandboxing of just-in-time compilation and self-modifying code

Language-independent sandboxing of just-in-time compilation and self-modifying code.

Verified just-in-time compiler on x86

Templates-based portable just-in-time compiler

Certified self-modifying code

Optimizing direct threaded code by selective inlining

Functional programming is not self-modifying code

Tracing vs. partial evaluation: comparing meta-compilation approaches for self-optimizing interpreters

Using hpm-sampling to drive dynamic compilation

Language-independent sandboxing of just-in-time compilation and self-modifying code