3

I want to implement a server for a protocol. For security reasons the parser should be isolated in its own thread from the rest of the program and only a bidirectional channel should be held open for communication.

The parser thread should lose any possibility to modify the other thread's memory and lose its power to do syscalls (using seccomp).

Is there an easy way to achieve this behavior for the parser thread in Rust?

Shepmaster
  • 388,571
  • 95
  • 1,107
  • 1,366
user3637203
  • 762
  • 5
  • 17
  • 4
    Have you read [the Rust book on Concurrency](https://doc.rust-lang.org/book/concurrency.html)? Thread safety is already guaranteed by the compiler when not writing unsafe statements. – E_net4 Sep 04 '16 at 18:04
  • I know, but I want a safety net. – user3637203 Sep 04 '16 at 18:22
  • 4
    A "safety net"? What exactly would that be, and how would it fill a gap in Rust concurrent programming? – E_net4 Sep 04 '16 at 18:24
  • What if there is a bug in Rust's libstd. Then you can actually get a buffer overflow. – user3637203 Sep 04 '16 at 19:24
  • 2
    Now you're just speaking of an extremely unlikely use case that no one would have thought of without it having mentioned in the question. Try to be more specific. Perhaps if you narrow it down to "using seccomp for sandboxing a server in Rust", you might get an answer. Have you also tried anything before asking? – E_net4 Sep 04 '16 at 19:27

1 Answers1

2

If you're concerned about issues beyond what Rust's strong safety and type system can protect against (e.g. bugs in those, or in third-party libraries etc.) then you really want separate processes rather than just threads; even if you use seccomp on an untrusted thread, at the OS/CPU level it still has full write access to other threads' memory in the same process.

Either way you'll need to write code designed to run in seccomp carefully (for example allocating extra heap memory might not work) - but the good news is that Rust is a great language for having that control!

There's a reasonably useful discussion on seccomp in Rust which has some suggestions.

The best bet looks like gaol from the Servo project, which is a more general process sandbox (including seccomp). There are also some other lower level seccomp wrappers like this one.

I haven't tried any of this yet, so I'd be interested to hear any other viewpoints/experience.

Shepmaster
  • 388,571
  • 95
  • 1,107
  • 1,366
Chris Emerson
  • 13,041
  • 3
  • 44
  • 66