| OLD | NEW |
| (Empty) |
| 1 About | |
| 2 ===== | |
| 3 | |
| 4 This is a prototype for plumbing Mojo into the NaCl sandbox. It is | |
| 5 currently insecure (see below), does not provide a stable ABI (IRT | |
| 6 support must be added), and does not support Mojo functions that | |
| 7 return pointers (for example, `MojoMapBuffer`). | |
| 8 | |
| 9 | |
| 10 Using | |
| 11 ===== | |
| 12 | |
| 13 To use this prototype run `mojo/tools/mojob.py gn --nacl` and then build | |
| 14 and test as usual. | |
| 15 | |
| 16 Run `mojo/tools/mojob.py nacltest` for additional nacl-specific tests. | |
| 17 | |
| 18 | |
| 19 Notes | |
| 20 ===== | |
| 21 | |
| 22 `generator/interface.py` contains a programmatic description of the | |
| 23 stable Mojo interface. This will need to be updated as the interface | |
| 24 changes. Run `generator/generate_nacl_bindings.py` to generate the | |
| 25 bindings that plumb this interface into the NaCl sandbox. | |
| 26 | |
| 27 | |
| 28 Security TODO | |
| 29 ============= | |
| 30 | |
| 31 * Separate trusted and untrusted Mojo handles. | |
| 32 * Validate and copy option structures. | |
| 33 * Protect untrusted buffers passed into Mojo: | |
| 34 * `NaClVmIoWillStart/HasEnded`. | |
| 35 * volatile accesses to untrusted memory (untrusted code could race). | |
| 36 * Overflow checking in array bounds validation. | |
| 37 | |
| OLD | NEW |