About

This is a prototype for plumbing Mojo into the NaCl sandbox. It is currently insecure (see below), does not provide a stable ABI (IRT support must be added), and does not support Mojo functions that return pointers (for example, MojoMapBuffer).

Using

To use this prototype, point your .gclient file to DEPS.nacl instead of DEPS and then run gclient sync.

When you run mojo/tools/mojob.py gn, add --nacl to the command line.

Run mojo/tools/mojob.py nacltest for additional nacl-specific tests.

Notes

generator/interface.py contains a programmatic description of the stable Mojo interface. This will need to be updated as the interface changes. Run generator/generate_nacl_bindings.py to generate the bindings that plumb this interface into the NaCl sandbox.

Security TODO

• Separate trusted and untrusted Mojo handles.
• Validate and copy option structures.
• Protect untrusted buffers passed into Mojo:
  • NaClVmIoWillStart/HasEnded.
  • volatile accesses to untrusted memory (untrusted code could race).
• Overflow checking in array bounds validation.