diff options
| author | Daniel Micay <daniel.micay@grapheneos.org> | 2024-12-20 15:29:02 -0500 |
|---|---|---|
| committer | Daniel Micay <daniel.micay@grapheneos.org> | 2024-12-20 15:29:29 -0500 |
| commit | 5bccb7d3221792f0e2c9bd326ec22b23fe028444 (patch) | |
| tree | 7223ef4a42b4033cbe78b6e78944fcb4cbbfd0f0 /static/features.html | |
| parent | f082e6f1c688e106bd27628a95bbdf2d619807c6 (diff) | |
expand dynamic code loading blocking documentation
Diffstat (limited to 'static/features.html')
| -rw-r--r-- | static/features.html | 29 |
1 files changed, 22 insertions, 7 deletions
diff --git a/static/features.html b/static/features.html index 3ba73001..e77c2753 100644 --- a/static/features.html +++ b/static/features.html @@ -407,13 +407,28 @@ only JIT compilation in the base OS is the V8 JavaScript JIT which is disabled by default for the Vanadium browser with per-site exception support.</li> - <li>Prevention of dynamic native code execution via either memory or - storage for the base OS including nearly all the base OS apps. For the - OS itself, only the processes involved in the OS package management - system can write data to storage that can be executed and only the - media DRM sandbox can do in-memory dynamic native code execution. The - Vanadium browser and WebView are excluded in order to support the JS - JIT compiler.</li> + <li>Dynamic code loading for both native code or Java/Kotlin classes is + blocked for nearly the entire base OS to prevent base OS processes. This + works alongside verified boot to prevent base OS processes from running + attacker controlled native code or Java/Kotlin code. The only exceptions + from the policy for the base OS are in-memory code loading for the media + DRM sandbox and the Vanadium JIT compiler being permitted. Vanadium has + JIT compilation disabled by default for every site and for apps using + the WebView with the exception of our PDF Viewer app. Vanadium disables + the JIT compiler by default with a per-site and per-app toggle for it + and per-process enforcement of blocking dynamic code loading implemented + with seccomp-bpf based on the per-site/per-app JIT compiler toggle.</li> + <li>Dynamic code loading for both native code or Java/Kotlin classes can + be disabled for user installed apps via 3 exploit protection toggles: + Dynamic code loading from memory, Dynamic code loading from storage and + WebView JIT. This can also be used to opt-out of the WebView JIT for our + PDF Viewer and dynamic code loading from memory for the Vanadium browser + to disable support for the per-site opt-in to JIT compilation. In order + to make the dynamic code loading toggles more usable, we show a user + facing notification when an app has dynamic code loading from memory or + storage blocked, including a file path being shown when it's blocked + from storage. This allows users to disable it for all their apps and + then enable them for the ones requiring it.</li> <li>Filesystem access hardening</li> </ul> </section> |