To guarantee strong isolation between components, it is suggested to create separate process for database connections and execute methods, thus decreasing memory corruption errors on processing not-sanitized data and minimizing the attack surface on malicious external components. This will allow to execute foreign components that extends the main binary functionality replacing dynamic library loading, which exposes the main process' address space to the foreign component potentially increasing the attack surface.
Arquitecture
- For tier 0 components (those that are already integrated in the main binary) workers are an instance of the same executor (server) binary and runs an isolated component (e.g. a database connection handler), as a a result we obtain a hybrid binary both hosting the executor and worker initialization logic, the binary will detect its role on startup using appropriate flags.
- For foreign components (tier 1), you would only want to ship the worker initialization logic.
The proposed mechanism is an asynchronous IPC shared-memory worker using iceoryx2 which provides zero-copy, lock-free IPC with constant latency.
Each worker will have their own Tokio runtime, so that multiple concurrent requests are processed asynchronously (each worker is granted a multithreaded runtime).
The IPC logic would be implemented as a dyn Any* implementation that acts as a proxy for the IPC (maybe called Foreign*).
Implementation roadmap
- Write the IPC proxy type.
- Implement the worker initialization and lifecycle.
- Setup a message passing mechanism.
To guarantee strong isolation between components, it is suggested to create separate process for database connections and execute methods, thus decreasing memory corruption errors on processing not-sanitized data and minimizing the attack surface on malicious external components. This will allow to execute foreign components that extends the main binary functionality replacing dynamic library loading, which exposes the main process' address space to the foreign component potentially increasing the attack surface.
Arquitecture
The proposed mechanism is an asynchronous IPC shared-memory worker using
iceoryx2which provides zero-copy, lock-free IPC with constant latency.Each worker will have their own
Tokioruntime, so that multiple concurrent requests are processed asynchronously (each worker is granted a multithreaded runtime).The IPC logic would be implemented as a
dyn Any*implementation that acts as a proxy for the IPC (maybe calledForeign*).Implementation roadmap