Gobi: WebAssembly as a Practical Path to Library Sandboxing
Shravan Narayan, Tal Garfinkel, Sorin Lerner, Hovav Shacham, Deian, Stefan

TL;DR
Gobi demonstrates how WebAssembly can be used to sandbox native C/C++ libraries within applications, bridging the gap between browser-based and native sandboxing techniques for improved security.
Contribution
Gobi introduces a system of compiler modifications and runtime support that enables WebAssembly-based sandboxing of native C/C++ libraries in applications.
Findings
Successfully sandboxed libjpeg, libpng, and zlib using Gobi.
Gobi bridges WebAssembly sandboxing with native application libraries.
Highlights ongoing challenges and future directions for WebAssembly sandboxing.
Abstract
Software based fault isolation (SFI) is a powerful approach to reduce the impact of security vulnerabilities in large C/C++ applications like Firefox and Apache. Unfortunately, practical SFI tools have not been broadly available. Developing SFI toolchains are a significant engineering challenge. Only in recent years have browser vendors invested in building production quality SFI tools like Native Client (NaCl) to sandbox code. Further, without committed support, these tools are not viable, e.g. NaCl has been discontinued, orphaning projects that relied on it. WebAssembly (Wasm) offers a promising solution---it can support high performance sandboxing and has been embraced by all major browser vendors---thus seems to have a viable future. However, Wasm presently only offers a solution for sandboxing mobile code. Providing SFI for native application, such as C/C++ libraries requires…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsSecurity and Verification in Computing · Advanced Malware Detection Techniques · Digital and Cyber Forensics
