diff options
| author | Daniel Micay <danielmicay@gmail.com> | 2022-05-09 16:26:44 -0400 |
|---|---|---|
| committer | Daniel Micay <danielmicay@gmail.com> | 2022-05-09 16:26:44 -0400 |
| commit | 6258b1c2c202eda2f3b872ea7e4bdef4b1ace951 (patch) | |
| tree | c36f63fc1ad48d1bbffc061ceffe8e0c68f77e1f /static/features.html | |
| parent | e5a0f9ac52fae3591796d75f72805e6ff97b9a76 (diff) | |
split sandboxing out of exploit mitigations
Diffstat (limited to 'static/features.html')
| -rw-r--r-- | static/features.html | 17 |
1 files changed, 16 insertions, 1 deletions
diff --git a/static/features.html b/static/features.html index dcf89ef2..5318388b 100644 --- a/static/features.html +++ b/static/features.html @@ -96,6 +96,8 @@ reduction</a></li> <li><a href="#exploit-mitigations">Exploit mitigations</a></li> + <li><a href="#improved-sandboxing">Improved + sandboxing</a></li> <li><a href="#anti-persistence">Anti-persistence / detection</a></li> </ul> @@ -229,7 +231,6 @@ <ul> <li>Hardened app runtime</li> - <li>Stronger app sandbox</li> <li><a href="https://github.com/GrapheneOS/platform_bionic">Hardened libc</a> providing defenses against the most common classes of vulnerabilities (memory corruption)</li> @@ -313,6 +314,20 @@ </ul> </section> + <section id="improved-sandboxing"> + <h4><a href="#improved-sandboxing">Improved sandboxing</a></h4> + + <p>GrapheneOS improves the app sandbox through hardening SELinux policy + and seccomp-bpf policy along with all the hardening to components like + kernel implementing the app sandbox and providing a path for the attacker + to escape it if they can exploit those components. We primarily focus on + the app sandbox, but we also improve the other sandboxes including making + direct improvements to the web browser renderer sandbox used for both the + default browser and WebView rendering engine provided by the OS and used + by a huge number of other apps from dedicated browsers to messaging + apps.</p> + </section> + <section id="anti-persistence"> <h4><a href="#anti-persistence">Anti-persistence / detection</a></h4> |