[demo][policy][PoC] Preliminary research on MAC policy and beyond

[t2ym]

[demo][policy][PoC] Preliminary research on MAC policy and beyond

demo/policy.html independent of hooking

Ad-hoc approaches (which may drastically change)

• [ ] Property-to-Policy mapping
  • [ ] Consideration on memory leak
  • [ ] WeakMap to avoid memory leaking by confined policies (design issue)
  • [ ] (Dropped for now) Policy as a hidden property cannot detect memory leaking
    • [ ] object is not freed due to sticky object[S_POLICY] = policy
  • [ ] Policy scopes for object.property (design issue)
  • [ ] object policy (object -> policy)
    • [ ] Raw function calls and new operators, etc.
    • [ ] A single object can have multiple policies (design issue)
  • [ ] property policy (object.property -> policy)
    • [ ] Access to property of object
  • [ ] value policy (object.property value -> policy)
    • [ ] Policy for (object or function) value of object.property
    • [ ] Value can be associated to multiple policies (design issue)
  • [ ] Default policies must have types
  • [ ] Type of objects (with different prototype chains)
    • [ ] function
    • [ ] object
    • [ ] symbol
    • [ ] string
    • [ ] number
    • [ ] boolean
    • [ ] undefined
  • [ ] Property mutations and policy mapping
  • [ ] Property-to-policy mapping must be updated on property mutations
    • [ ] read access
    • [ ] write access
    • [ ] Different types must have their matching policies
      • [ ] For example, function and Array values for the same property must have different policies
    • [ ] delete
    • [ ] chain access like Object.setPrototypeOf(), .__proto__ =, etc.
    • [ ] How to manipulate scopes of policies on mutations
  • [ ] Policies for non-global objects like modules
  • [ ] Representation of module policies
  • [ ] Handle property descriptors
  • [ ] Access to property descriptors
  • [ ] Policies for getter/setter functions
  • [ ] Handle multiple sets of global objects from different iframes
  • [ ] iframe.contentWindow !== window and so do its properties
• [ ] Prototype chain and instance
  • [ ] Instance and chained prototypes should have different policies
  • [ ] For example, [].map and Array.prototype.map should have different policies
• [ ] Policy compiler
  • [ ] Prototype chaining of policies
  • [ ] Policy function generation
  • [ ] Sharing of policy functions for resource reduction and performance
    • [ ] Caching of policy functions
  • [ ] Simple ACLs
  • [ ] Complex normalizations of arguments
    • [ ] Property access with Object.defineProperty(), Object.getOwnPropertyDescriptors(), etc.
    • [ ] Bound functions with bind()
    • [ ] Function calls with apply() and call()
    • [ ] DOM normalization
    • [ ] document.createElement('tag') -> HTML{Tag}Element
    • [ ] Custom elements
    • [ ] Tags in innerHTML
    • [ ] Trusted Types
    • [ ] ...
    • [ ] Meta-hooking
    • [ ] new Function(), new GeneratorFunction(), new AsyncGeneratorFunction()
    • [ ] eval()
    • [ ] setTimeout(), setInterval()
    • [ ] ...
    • [ ] and more...
• [ ] Context-to-Policy mapping
• [ ] Issues
  • [x] policyMap.get(window) has many extra policies
• [ ] More...

[t2ym]

PoC applyPolicy() performance on Mac Mini 2014 Core i5 with Chrome 67

• Primitive object.property-to-policy mapping
• demo/policy.html is independent of hooking for now (as of https://github.com/t2ym/thin-hook/commit/6ca82852c24f9b07bd021624611d95780eb00a83)

  24,570,024 op/s     40 ns/op true A A.Symbol(policy) 
  30,864,197 op/s     32 ns/op true A.prototype A.prototype.Symbol(policy) 
  30,959,752 op/s     32 ns/op true new A() A.prototype.Symbol(policy) 
  12,787,723 op/s     78 ns/op true (new A()).instanceMethod A.prototype.instanceMethod.Symbol(policy) 
  12,755,102 op/s     78 ns/op true (new A()).instanceProperty A.prototype.instanceProperty.Symbol(policy) 
  12,562,814 op/s     79 ns/op true A.staticMethod property A.staticMethod.Symbol(policy) 
  16,806,722 op/s     59 ns/op true A.staticMethod object A.staticMethod.Symbol(policy) 
  12,690,355 op/s     78 ns/op true A.staticMethod.apply Function.prototype.apply.Symbol(policy) 
  12,360,939 op/s     80 ns/op true (new A()).hasOwnProperty Object.prototype.hasOwnProperty.Symbol(policy) 
  11,627,906 op/s     86 ns/op true Symbol.hasInstance Symbol.hasInstance.Symbol(policy) 
  10,989,010 op/s     91 ns/op true Symbol.hasInstance.toString Symbol.prototype.toString.Symbol(policy) 
  11,918,951 op/s     83 ns/op true Symbol.unscopables Symbol.unscopables.Symbol(policy) 
  11,325,028 op/s     88 ns/op true Symbol.unscopables.toString Symbol.prototype.toString.Symbol(policy) 
  12,269,938 op/s     81 ns/op true Symbol.for Symbol.for.Symbol(policy) 
  17,152,658 op/s     58 ns/op true [] Array.prototype.Symbol(policy) 
  13,106,159 op/s     76 ns/op true Array.isArray property Array.isArray.Symbol(policy) 
  17,241,379 op/s     58 ns/op true Array.isArray object Array.isArray.Symbol(policy) 
  13,458,950 op/s     74 ns/op true [].map Array.prototype.map.Symbol(policy) 
  13,586,956 op/s     73 ns/op true [].forEach property Array.prototype.forEach.Symbol(policy) 
  10,319,917 op/s     96 ns/op true [].forEach object Array.prototype.forEach.Symbol(policy),NodeList.prototype.forEach.Symbol(policy) 
  12,315,270 op/s     81 ns/op true B.__proto__.constructor property Function.Symbol(policy) 
  16,393,442 op/s     61 ns/op true B.__proto__.constructor object Function.Symbol(policy) 
  13,020,833 op/s     76 ns/op true new B().constructor B.Symbol(policy) 
  12,936,610 op/s     77 ns/op true ['a'][0] Array.prototype.Symbol(default).Symbol(policy) 
  13,477,088 op/s     74 ns/op true B[Symbol.hasInstance] B.Symbol(Symbol.hasInstance).Symbol(policy) 
  13,513,513 op/s     74 ns/op true moduleA.classA property moduleA.classA.Symbol(policy) 
  10,000,000 op/s    100 ns/op true moduleA.classA object moduleA.classA.Symbol(policy),moduleB.classA.Symbol(policy) 
  12,987,012 op/s     77 ns/op true moduleB.classA moduleB.classA.Symbol(policy) 
  7,656,967 op/s    130 ns/op true moduleA.classA.staticMethodA property moduleA.classA.staticMethodA.Symbol(policy),moduleB.classA.staticMethodA.Symbol(policy) 
  9,661,835 op/s    103 ns/op true moduleA.classA.staticMethodA object moduleA.classA.staticMethodA.Symbol(policy),moduleB.classA.staticMethodA.Symbol(policy) 

[t2ym]

Notes on SELinux (as MAC models)

• The context of a file object follows on moving it in the file systems. Relabeling of the context is required to make the context match with the new path of the file object.