From derek.br...@gmail.com on May 17, 2010 17:33:07

in r333 I added a pretty good step toward best-effort isolation, given that we can't
easily swap the whole segment selector. I'm lowering the priority of any further
isolation to Low as it will be handled on an as-needed basis.

My r333 change adds isolation of two data structures:

1. PEB isolation

• Use a private PEB copy. Since we can't create a segment descriptor from
  user mode for Win64, giving up on swapping TEB: we'll have to swap
  individual fields there. For PEB, if everyone accesses via TEB, we can
  have a copy of that and swap with one store. Have to swap on every clean
  call and client event cb.
• We just do a shallow copy for now until we hit an issue w/ deeper fields
  that are allocated at our init time.
  Anything allocated by libraries after our init here will of
  course get its own private deep copy.
• We do not intercept private libs calling NtQueryInformationProcess to get
  info.PebBaseAddress (not exposed in any WinAPI routine) but I tried to
  have a client use that method to get the real app PEB and it turns out the
  query syscall goes and reads the TEB pointer to the PEB!
• We need private PEB in place whenever call client code, so to get the app's
  PEB I added an API routine (since NtQueryInformationProcess doesn't work).
• Add options to control the existing heap isolation, which was added by me
  in my original private loader code (-privload_privheap), and to control
  peb isolation (-private_peb)

2. TEB->FlsData isolation

• With isolation of the TEB->FlsData field added, all the errors stemming
  from transparency violations (on tests/malloc.exe) go away.
• Because TEB->FlsData is more expensive to isolate (persistent and varies
  per thread), the code to swap it is only invoked when a client with
  dependent libraries is present

Labels: -Priority-Medium Priority-Low

From bruen...@google.com on January 22, 2013 12:53:53

Fibers (Windows user-mode lightweight threads) swap TEB fields when they swap contexts. They do this via regular memory copies, so there's nothing special to help us out there. But, we should look at the fiber TEB switch to see the full list of fields and sub-fields we'd need to copy for full isolation.