Native Client: A Sandbox for Portable, Untrusted x86 Native Code

By Bennet S. Yee, D. Sehr, Gregory Dardyk, J. B. Chen, Robert Muth, Tavis Ormandy, S. Okasaka, Neha Narula, Nicholas Fullagar. IEEE Symposium on Security and Privacy, 2009

803 citations recorded by the source corpus.

Subfields: Computer Networks and Communications

View Paper: https://www.semanticscholar.org/paper/0ed45886cdf1027d71272a64434d720d3baa3fc1

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Networks and Communications

Citations in the corpus

Aurasium: Practical Policy Enforcement for Android Applications (2012, positive): “Previous work [28, 40, 34] on securely executing untrusted native code provides useful directions for example, by using dynamic binary translation.”
Control Flow Integrity for COTS Binaries (2013, background): “An important feature of CFI is that it can be meaning- ∗This work was supported in part by AFOSR grant FA9550-09-10539, NSF grant CNS-0831298, and ONR grant N000140710928. fully enforced on binaries.”
Binary stirring: self-randomizing instruction addresses of legacy x86 binary code (2012, methodology): “There are a large body of rewriting techniques, including PittsField [39], Google Native Client [61], and Diablo [56].”
Return-oriented programming without returns (2010, methodology): “For the use of related techniques in the context of code injection, see [10, 27, 8]. near jumps, which take a 32-bit address in the current segment; and far jumps, which take a 32-bit address together with a 16-bit segment selector.”
Faasm: Lightweight Isolation for Efficient Stateful Serverless Computing (2020, background): “WebAssembly is a secure portable IR [29] and the successor to Native Client.”
Execute This! Analyzing Unsafe and Malicious Dynamic Code Loading in Android Applications (2014, background): “One possible approach could be to encapsulate native code in a sandbox environment similar to Google Native Client [29], [36].”
Dune: Safe User-level Access to Privileged CPU Features (2012, neutral): “A wide range of strategies have been employed to support sandboxing, such as ptrace [16], dedicated kernel modifications [16, 21, 33], binary translation [19], and binary verification [39].”
Stitching the Gadgets: On the Ineffectiveness of Coarse-Grained Control-Flow Integrity Protection (2014, neutral): “[43].”
SoK: Automated Software Diversity (2014, methodology): “As the implementations of most of the techniques we discussed are not publically available, we rely on self-reported performance numbers from their authors.”
Graphene-SGX: A Practical Library OS for Unmodified Applications on SGX (2017, methodology): “[34] built a 2-way sandbox for x86 by separating the Native Client (NaCl) [55] sandbox into modules for sandboxing and service runtime to support application execution and use Trustvisor [39] to protect the piece of application logic from the untrusted OS.”
Bringing the web up to speed with WebAssembly (2017, background): “Previous attempts at solving it, from ActiveX to Native Client to asm.js, have fallen short of properties that a low-level compilation target should have: • Safe, fast, and portable semantics: safe to execute fast to execute language-, hardware-, and platform-independent deterministic and easy to re”
Chiron: Privacy-preserving Machine Learning as a Service (2018, methodology): “Ryoan is based on Native Client [53, 66], which uses compiler techniques to conﬁne code.”
This Paper Is Included in the Proceedings of the 12th Usenix Symposium on Operating Systems Design and Implementation (osdi '16). Ryoan: a Distributed Sandbox for Untrusted Computation on Secret Data Ryoan: a Distributed Sandbox for Untrusted Computation on Secret Data (positive): “For the Ryoan prototype we chose Native Client (NaCl) [64, 74], a state of the art user-level sandbox, as our basis (it can be built as a standalone binary, independent from the browser).”
A design and verification methodology for secure isolated regions (2016, methodology): “Our runtime checks are related to previous work on software fault isolation (SFI [27, 39, 44, 47]), but we note that a simple SFI policy of sandboxing all the code in the SIR”
Crying Wolf: An Empirical Study of SSL Warning Effectiveness (2009, methodology): “In recent work, Native Client [47] and Xax [15] have presented a plugin model that uses sandboxed processes to contain each browser principal’s plugin content.”
Sanctum: Minimal Hardware Extensions for Strong Software Isolation (2016, methodology): “The enclave runtime can use Native Client’s approach [62] to ensure that the rest of the enclave software only interacts with the host application via the runtime to mitigate potential security vulnerabilities in enclave software.”
überSpark: Enforcing Verifiable Object Abstractions for Automated Compositional Security Analysis of a Hypervisor (2016, methodology): “Verified sandboxing – SFI [52], [54], [60], [76], [82] is a software-based approach for application-level memory isolation but lacks support for low-level privileged instructions and hardware device access, which are necessary for hypervisor and its extensions.”