On Mon, 11 Jun 2018 07:56:50 -0600

> In a browser, there are 2 main security components you want: The main
> security advantage is privsep.  The other is W^X jit.  Other security
> effects will follow from those design choices, especially if you have
> privsep.  For instance, the chrome privsep is nicely refined and
> pledge enforcements could be added.

This is surely of far less interest than the ability to pledge but
perhaps of interest.

These are the Windows 10 1803 exploit protection settings that I have
found can be enabled without crashing chrome then firefox. There seems
to be a few targeted at ROP that firefox runs with but break Chrome.

  <AppConfig Executable="C:\Program Files
  (x86)\Google\Chrome\Application\chrome.exe"> <DEP Enable="true"
  EmulateAtlThunks="false" /> <ASLR ForceRelocateImages="true"
  RequireInfo="true" BottomUp="true" HighEntropy="true" />
  <StrictHandle Enable="true" /> <ExtensionPoints
  DisableExtensionPoints="true" /> <ControlFlowGuard Enable="true"
  SuppressExports="false" /> <SignedBinaries
  EnforceModuleDependencySigning="true" /> <Fonts
  DisableNonSystemFonts="true" AuditOnly="false" Audit="false" />
  <ImageLoad BlockRemoteImageLoads="true" AuditRemoteImageLoads="false"
  BlockLowLabelImageLoads="true" AuditLowLabelImageLoads="false" />
  <Payload EnableImportAddressFilter="false"
  EnableRopSimExec="false" /> <SEHOP Enable="true"
  TelemetryOnly="false" /> <Heap TerminateOnError="true" />

  <AppConfig Executable="C:\Program Files\Mozilla Firefox\firefox.exe">
    <DEP Enable="true" EmulateAtlThunks="false" />
    <ASLR ForceRelocateImages="true" RequireInfo="true" BottomUp="true"
  HighEntropy="true" /> <StrictHandle Enable="true" />
    <ExtensionPoints DisableExtensionPoints="true" />
    <ControlFlowGuard Enable="true" SuppressExports="false" />
    <SignedBinaries EnforceModuleDependencySigning="true" />
    <Fonts DisableNonSystemFonts="true" AuditOnly="false"
  Audit="false" /> <ImageLoad BlockRemoteImageLoads="true"
  AuditRemoteImageLoads="false" BlockLowLabelImageLoads="true"
  AuditLowLabelImageLoads="false" /> <Payload
  EnableExportAddressFilter="true"
  AuditEnableExportAddressFilter="false"
  EnableExportAddressFilterPlus="true"
  AuditEnableExportAddressFilterPlus="false"
  EnableImportAddressFilter="true"
  AuditEnableImportAddressFilter="false" EnableRopStackPivot="true"
  AuditEnableRopStackPivot="false" EnableRopCallerCheck="true"
  AuditEnableRopCallerCheck="false" EnableRopSimExec="true"
  AuditEnableRopSimExec="false" /> <SEHOP Enable="true"
  TelemetryOnly="false" /> <Heap TerminateOnError="true" /> </AppConfig>

Reply via email to