Chromium (Chrome) Sandbox Details

What Sandbox does?

Sandbox leverages the os-provided security to allow code execution this cannot make persistent changes to the computer or Access information is confidential.

What's the Sandbox ' s structure is?

Sandbox operates at Process-level granularity. Anything that needs to being sandboxed needs to live on a separate process.

The minimal sandbox configuration has processes:one a privileged controller known as the broker, and One or more sandboxed processes known as the target.

　　

Broker

Browser process (Chromium):

1. Specify the policy for each target process
2. Spawn the target processes
3. Host the sandbox policy engine service
4. Host the Sandbox interception manager
5. Host the Sandbox IPC service (to the target processes)
6. Perform the policy-allowed actions on behalf of the target process

Target

Renderers process, the hosts all the code that's going to run inside the sandbox:

1. All code to be sandboxed
2. The Sandbox IPC client
3. The Sandbox policy engine client
4. The sandbox interceptions

Target Process Restrictions:

• • Forbid per-use system-wide changes using SystemParametersInfo() , which can used to swap the mouse buttons or set the screen saver Timeou T
  • Forbid the creation or switch of desktops
  • Forbid changes to the Per-user display configuration such as resolution and primary display
  • No read or write to the Clipboard
  • Forbid Windows message broadcasts
  • Forbid setting global Windows hooks (using SetWindowsHookEx() )
  • Forbid access to the global atoms table
  • Forbid access to USER handles created outside the Job object
  • One active process limit (disallows creating child processes)

Allowed resource access:

• • Read access to most files
  • Write access to%USER PROFILE%\AppData\LocalLow
  • Read access to most of the registry
  • Write access toHKEY_CURRENT_USER\Software\AppDataLow
  • Clipboard (copy and paste for certain formats)
  • Remote procedure Call (RPC)
  • TCP/IP Sockets
  • Window messages Exposed viaChangeWindowMessageFilter
  • Shared memory exposed via LI (low integrity) labels
  • COM interfaces with LI (low integrity) Launch activation rights
  • Named Pipes exposed via LI (low integrity) labels

Refers:

Https://chromium.googlesource.com/chromium/src/+/master/docs/design/sandbox.md

Chromium (Chrome) Sandbox Details