Chrome 20 On Linux Gives Seccomp Filters For Flash

I was reading the scarybeast blog and he mentions that Chrome 20 now implements the seccomp filters for its Flash plugin.

That means that Flash is now running in a chroot (separate file system) and namespace and it has a whitelist of syscalls.

This is a significant improvements. The thing about sandboxing is that you can only restrict processes with lower rights ie: hardware can constrain the kernel, kernel -> admin, admin -> user, etc. So if I’m being held by an admin account and I get a kernel exploit and get escalation I’ve just made breaking out of that sandbox a whole lot simpler. Chroot happens to have multiple weaknesses when trying to hold a root user (you can compile with grsecurity to remove these) so keeping Flash from elevating privileges will help keep it in its own little chroot’d environment.

Seccomp filters directly reduces kernel attack surface, which prevents kernel exploitation. This is a really nice step forward.

Adobe Flash has long been a source for exploitation on the Windows OS so it’s nice to see it get locked down further on Linux.

Seccomp support is in the 3.5 kernel and Ubuntu 12.04.