DOCSLIB.ORG

Capsicum and Casper - a Fairy Tale About Solving Security Problems

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text
Capsicum and Casper - a Fairy Tale About Solving Security Problems Capsicum and Casper - a fairy tale about solving security problems Mariusz Zaborski Wheel Systems, FreeBSD [email protected] 1 Introduction • stdio - one of the most common, allows us to allo- cate memory, and perform basic io operations (like Every year the list of security bugs is shocking. Oper- using stdout), ating systems start to innovate new mitigation techniques like ASLR or canneries which only makes exploiting • rpath - allows functions which only cause read-only harder but many in many cases still possible. We also try effects on the filesystem (eg. open(2) on an existing to mitigate on a lower level like the NX bit in the CPU, file with read flag only), but researchers again have found a method of bypassing • wpath - allows system calls which may cause write- this technique by the so-called return oriented program- effects on filesystems, ing. Another way of handling security problems is by us- • cpath - allows functions which may create new files, ing a sandbox environment. Some researches try to use a • proc and exec - allow to fork and execute another sandbox on a big scale, like running different virtual ma- program. chines for different tasks, while others try to use them on a smaller scale like in a process. In this article we focus Pledge always allows you to reduce permissions by sim- just on two of them. Process sandboxing should be easy, ply calling pledge(2) again. flexible, scalable and lightweight. Two of the most recent Statistics show that Pledge is very easy to use to sand- work in BSD world deserve for our attention - Capsicum box application. Over 400 programs in OpenBSD use and Pledge. pledge. These sandboxing techniques have their strengths and At listing 1 we have an example of how cat(1) program weaknesses. Process sandboxing can sometimes be too was sandboxed using pledge(2). The program has access restrictive for some of the challenges found in the real to stdio (cat(1) needs stdout to print result) and have ac- world and this is the moment when Casper enters the cess to all filesystem as long as it is read only. A big scene. advantage is that cat(1) can’t create any socket or pass descriptors. So in the end the usage of Pledge comes 2 Pledge to understanding the program and to giving it the right promises. Pledge (historically tame) is a sandbox framework cre- @@ −66,6 +66,9 @@ ated for OpenBSD project [1]. Pledge assumes that we can divide any program into two parts. One of which setlocale(LCn ALL , ” ” ) ; is the initialization phase in which all the preparations i f (pledge(”stdio rpath”, NULL) == −1) are performed (e.g. arguments parsing) and the other err(1, ”pledge”); one which is the main loop, containing the actual op- erations (e.g. parsing a file). Pledge allows us to de- while ((ch = getopt(argc, argv, ”benstuv”)) != −1) cide which system calls can by be accessed by so called switch ( ch ) f ”promises”. Each promise gives us a different set of sys- case ’ b ’ : tem calls with different options. At the moment Pledge Listing 1: pledge(2) used in a cat(1) program in implements around 24 promises, in which we can count: OpenBSD. [2] As you can see in the listing 1 pledge has two argu- Capabilities in Capsicum are represented by file descrip- ments. The first was already describe in depth earlier. In tors. In sandbox you can’t create a new descriptor from the future it will be possible to pass as a second argument global namespace, but you can still use privileges that a list of paths which will be whitelisted from the Pledge you already have. For instance, you can’t open any new sandbox. At the time of writing this article these options files2, but we can use capability which we have, lets say were not yet implemented and always end with the error descriptor to the directory and using openat(2) syscall we message: ”Invalid argument”. can still open files from that directory. In Capsicum we What is also very interesting and also quite surprising have two ways to obtain capabilities. The first way is to is that the author of Pledge has hard coded paths to some get credentials before entering sandbox, so for example files in the kernel. For example, even in sandbox, you are in the initial phase of the program we open files, create always able to do operations like: sockets and then enter sandbox to perform complicated algorithms. The second way is to obtain them from other • open(2) files like /etc/localtime and any files below process. File descriptors are ideal as the carrier of the ca- /usr/share/zoneinfo, pabilities, they can be inherited by a child process after fork and also if the two processes share an Unix domain • readlink(2) may operate on /etc/malloc.conf, socket descriptors can be passed around. • sysctl(3) read-only operations like getdomain- The second part of Capsicum allows us to limit the name(3), gethostname(3), getifaddrs(3), uname(3). process even further. Capability rights are a special flags added to file descriptors which tells the kernel how you As motioned earlier, you can use an exec promise can use them. We can limit descriptors to be read-only, which allow you to execute another program. This is an write-only, read-write but what is very interesting and example of promises which you should be very careful very useful is that you can even specify that descriptor about, and which unfortunately is over used1. The real to be append only3. In the FreeBSD we have defined problem with exec is that promises are not inherits be the around 80 capability rights. For example as file specific new process. If a potential attacker would exploit your rights we have: program he can try then run other application from your system which can lead to a security gap. • CAP FCHMOD allows change mode (fchmod(2)), Pledge in its assumption is very similar to the • CAP FSTAT allows getting file stats (fstat(2)), seccomp-bpf. The difference is that with pledge we have multiple predefined set of allowed/forbidden syscalls and • CAP UNLINKAT allows file deletion (unlinkat(2)). arguments. In case of seccomp-bpf we must define such list and it is easily desynchronized after every update [3]. A full list of the Capsicum capability rights can be found Pure seccomp-bpf is also very hard to use but now we in the FreeBSD rights(4) manual page. Capsicum was can use libseccomp which simplify it a lot. first introduced in FreeBSD 9.0. Currently, there is ongo- OpenBSD released pledge in 2015 and it is still con- ing work to port Capsicum to Linux and DragonFlyBSD sidered as experimental feature and its API can change. [5] [6]. 3 Capsicum 3.1 Sandboxing uniq(1) Capsicum is a lightweight OS capability and sand- As an example of using Capsicum in practice we will box framework implementing a hybrid capability system use a uniq(1) case. First what we need to do is to un- model [4]. The process sandbox system’s architecture in derstand what the program is doing. The uniq(1) is used FreeBSD can be divided into two modules: to filter out repeated lines in a file. In the code we can see that our application is operating on input and out- • Tight sandboxing (cap enter(2)) put descriptors. Both of them can be file or stdout/st- din descriptors. In listing 2 we have code responsible • Capability rights (cap rights limit(2)) for setting capability rights on descriptor. We are us- ing cap rights init(3) function to initialize a structure re- By calling cap enter(2) we enter a sandbox or so sponsible for keeping capabilities (cap rights t). Unfor- called capability mode. Capability mode is inherited by tunately the description of this structure is beyond this all descendent processes and cannot be removed. Any attempt to access to any global namespaces (such as path 2We can’t because we trying to access path namespace. names or pid namespace) will be prevented by the kernel. 3In our software at Wheel company we use such descriptor as log descriptor, if somebody would break in to the sandboxed program he 1At the moment around 70 programs is using it. can’t overwrite any previous log. 2 article but if you are interested why do we have it in such entering the main function we are already in the capa- form you can look into another article [9]. bility mode. If we want to open a socket or open files After setting up all descriptors we can enter capabil- in this environment we need to define a special YAML ity mode which we see on listing 3. Some perceptive file with will be parsed before executing a user code and reader can notice that we not only are checking result of after entering main function descriptors will be available cap rights limit(3) or cap enter(2) we also are checking for use. errno value. If the FreeBSD kernel is unable to enter ca- The author hopes that CloudABI will be used more pability mode it will fail but if it will fail with ENOSYS frequently in the Cloud platforms. that means that the FreeBSD kernel is compiled without Capsicum support and we want to continue execution. 5 Comparison c a p r i g h t s t r i g h t s ; ... i f p = s t d i n ; As we can see Capsicum and Pledge present a totally ifn = ”stdin”; different approach to the security problem.
Load more

Recommended publications
  • Katalog Elektronskih Knjiga
    KATALOG ELEKTRONSKIH KNJIGA Br Autor Naziv Godina ISBN Str. Porijeklo izdavanja 1 Peter Kent Pay Per Click Search 2006 0-471-74594-3 130 Kupovina Engine Marketing for Dummies 2 Terry Large Access 1 2007 Internet Freeware 3 Kevin Smith Excel Lassons & Tutorials 2004 Internet Freeware 4 Terry Michael Photografy Tutorials 2006 Internet Freeware Janine Peterson Phil Pivnick 5 Jake Ludington Converting Vinyl LPs 2003 Internet Freeware to CD 6 Allen Wyatt Cleaning Windows XP 2004 0-7645-7311-X Poklon for Dummies 7 Peter Kent Sarch Engine Optimization 2006 0-4717-5441-2 Kupovina for Dummies 8 Terry Large Access 2 2007 Internet Freeware 9 Dirk Dupon How to write, create, 2005 Internet Freeware promote and sell E-books on the Internet 10 Chayden Bates eBook Marketing 2000 Internet Freeware Explained 11 Kevin Sinclair How To Choose A 1999 Internet Freeware Homebased Bussines 12 Bob McElwain 101 Newbie-Frendly Tips 2001 Internet Freeware 13 Windows Basics 2004 Poklon 14 Michael Abrash Zen of Graphic 2005 Poklon Programming, 2. izdanje 15 13 Hot Internet 2000 Internet Freeware Moneymaking Methods 16 K. Williams The Complete HTML 1998 Poklon Teacher 17 C. Darwin On the Origin of Species Internet Freeware 2/175 Br Autor Naziv Godina ISBN Str. Porijeklo izdavanja 18 C. Darwin The Variation of Animals Internet Freeware 19 Bruce Eckel Thinking in C++, Vol 1 2000 Internet Freeware 20 Bruce Eckel Thinking in C++, Vol 2 2000 Internet Freeware 21 James Parton Captains of Industry 1890 399 Internet Freeware 22 Bruno R. Preiss Data Structures and 1998 Internet
    [Show full text]
  • Mac OS X Server Administrator's Guide
    034-9285.S4AdminPDF 6/27/02 2:07 PM Page 1 Mac OS X Server Administrator’s Guide K Apple Computer, Inc. © 2002 Apple Computer, Inc. All rights reserved. Under the copyright laws, this publication may not be copied, in whole or in part, without the written consent of Apple. The Apple logo is a trademark of Apple Computer, Inc., registered in the U.S. and other countries. Use of the “keyboard” Apple logo (Option-Shift-K) for commercial purposes without the prior written consent of Apple may constitute trademark infringement and unfair competition in violation of federal and state laws. Apple, the Apple logo, AppleScript, AppleShare, AppleTalk, ColorSync, FireWire, Keychain, Mac, Macintosh, Power Macintosh, QuickTime, Sherlock, and WebObjects are trademarks of Apple Computer, Inc., registered in the U.S. and other countries. AirPort, Extensions Manager, Finder, iMac, and Power Mac are trademarks of Apple Computer, Inc. Adobe and PostScript are trademarks of Adobe Systems Incorporated. Java and all Java-based trademarks and logos are trademarks or registered trademarks of Sun Microsystems, Inc. in the U.S. and other countries. Netscape Navigator is a trademark of Netscape Communications Corporation. RealAudio is a trademark of Progressive Networks, Inc. © 1995–2001 The Apache Group. All rights reserved. UNIX is a registered trademark in the United States and other countries, licensed exclusively through X/Open Company, Ltd. 062-9285/7-26-02 LL9285.Book Page 3 Tuesday, June 25, 2002 3:59 PM Contents Preface How to Use This Guide 39 What’s Included
    [Show full text]
  • Bibliography of Erik Wilde
    dretbiblio dretbiblio Erik Wilde's Bibliography References [1] AFIPS Fall Joint Computer Conference, San Francisco, California, December 1968. [2] Seventeenth IEEE Conference on Computer Communication Networks, Washington, D.C., 1978. [3] ACM SIGACT-SIGMOD Symposium on Principles of Database Systems, Los Angeles, Cal- ifornia, March 1982. ACM Press. [4] First Conference on Computer-Supported Cooperative Work, 1986. [5] 1987 ACM Conference on Hypertext, Chapel Hill, North Carolina, November 1987. ACM Press. [6] 18th IEEE International Symposium on Fault-Tolerant Computing, Tokyo, Japan, 1988. IEEE Computer Society Press. [7] Conference on Computer-Supported Cooperative Work, Portland, Oregon, 1988. ACM Press. [8] Conference on Office Information Systems, Palo Alto, California, March 1988. [9] 1989 ACM Conference on Hypertext, Pittsburgh, Pennsylvania, November 1989. ACM Press. [10] UNIX | The Legend Evolves. Summer 1990 UKUUG Conference, Buntingford, UK, 1990. UKUUG. [11] Fourth ACM Symposium on User Interface Software and Technology, Hilton Head, South Carolina, November 1991. [12] GLOBECOM'91 Conference, Phoenix, Arizona, 1991. IEEE Computer Society Press. [13] IEEE INFOCOM '91 Conference on Computer Communications, Bal Harbour, Florida, 1991. IEEE Computer Society Press. [14] IEEE International Conference on Communications, Denver, Colorado, June 1991. [15] International Workshop on CSCW, Berlin, Germany, April 1991. [16] Third ACM Conference on Hypertext, San Antonio, Texas, December 1991. ACM Press. [17] 11th Symposium on Reliable Distributed Systems, Houston, Texas, 1992. IEEE Computer Society Press. [18] 3rd Joint European Networking Conference, Innsbruck, Austria, May 1992. [19] Fourth ACM Conference on Hypertext, Milano, Italy, November 1992. ACM Press. [20] GLOBECOM'92 Conference, Orlando, Florida, December 1992. IEEE Computer Society Press. http://github.com/dret/biblio (August 29, 2018) 1 dretbiblio [21] IEEE INFOCOM '92 Conference on Computer Communications, Florence, Italy, 1992.
    [Show full text]
  • Capsicum: Practical Capabilities for UNIX
    Capsicum: practical capabilities for UNIX Robert N. M. Watson Jonathan Anderson Ben Laurie University of Cambridge University of Cambridge Google UK Ltd. Kris Kennaway Google UK Ltd. Abstract significant technical limitations: current OS facilities are simply not designed for this purpose. Capsicum is a lightweight operating system capabil- The access control systems in conventional (non- ity and sandbox framework planned for inclusion in capability-oriented) operating systems are Discretionary FreeBSD 9. Capsicum extends, rather than replaces, Access Control (DAC) and Mandatory Access Control UNIX APIs, providing new kernel primitives (sandboxed (MAC). DAC was designed to protect users from each capability mode and capabilities) and a userspace sand- other: the owner of an object (such as a file) can specify box API. These tools support compartmentalisation of permissions for it, which are checked by the OS when monolithic UNIX applications into logical applications, the object is accessed. MAC was designed to enforce an increasingly common goal supported poorly by dis- system policies: system administrators specify policies cretionary and mandatory access control. We demon- (e.g. “users cleared to Secret may not read Top Secret strate our approach by adapting core FreeBSD utilities documents”), which are checked via run-time hooks in- and Google’s Chromium web browser to use Capsicum serted into many places in the operating system’s kernel. primitives, and compare the complexity and robustness Neither of these systems was designed to address the of Capsicum with other sandboxing techniques. case of a single application processing many types of in- formation on behalf of one user. For instance, a mod- 1 Introduction ern web browser must parse HTML, scripting languages, images and video from many untrusted sources, but be- Capsicum is an API that brings capabilities to UNIX.
    [Show full text]
  • Sandboxing with Capsicum
    SECURITY Sandboxing with Capsicum PAWEL JAKUB DAWIDEK AND MARIUSZ ZABORSKI Pawel Jakub Dawidek is a ery few programmers have managed to successfully use the principle co-founder and CTO at Wheel of least privilege, as found in OpenSSH, Postfix, and djbdns. Capsi- Systems and a FreeBSD cum, introduced in 2010, adds a capability model designed to make it committer who lives and works V easier for programmers to reason about how to split a program into privileged in Warsaw, Poland. He is the and unprivileged portions. In this article, we describe the changes made in author of various GEOM classes, including the disk-encryption class GELI; he implemented Capsicum since 2010, compare Capsicum to earlier sandboxing techniques, the Highly Available Storage (HAST) daemon and look at the new Casperd, which makes it simpler to split programs. for distributing audit trail files (auditdistd), and Long ago, people started to recognize that security models proposed by the mainstream nowadays is mostly working on the Capsicum operating systems, including Windows, Mac OS X, and all kinds of UNIX-like systems, are framework and the Casper daemon. simply naive: All you need to do is to write programs that have no bugs. That’s indeed naive. [email protected] Let’s also state an obvious rule: The more code we write, the more bugs we introduce, some of which may jeopardize the security of our system. Once we accept this fact, where do we go? Mariusz Zaborski is currently We could only develop very small programs, which are easy to audit, but this again would be working as a software a bit naive.
    [Show full text]
  • Capabilities
    CS 261, Fall 2015 Scribe notes September 8: Capabilities Scribe: Riyaz Faizullabhoy 1 Motivation for Capabilities In The Confused Deputy, the compiler had two sets of rights: one from the user to access user files such as source code to compile, and another set granted to the compiler intended to access a special statistics file that would collect information about language feature usage. The compiler was installed in the SYSX directory, where it was granted access to write to any file in this directory. Naturally, the statistics file SYSX/STAT was also located in this directory such that the compiler (SYSX/FORT) could add language feature information. To achieve this, the compiler's privileges were set with a home files license that was allowed by the operating system to write to any file in the SYSX directory. A billing information file SYSX/BILL was also stored in SYSX { due to its sensitive nature, this billing file was not directly accessible to users. However, since the compiler was granted access to the entire SYSX directory, users could subvert their access restrictions on the billing information file by using the compiler like so: SYSX/FORT foo.f -o SYSX/BILL The above user-invoked command to the compiler would allow the compiler to first read the user's source code in foo.f, but then the compiler's privilege to SYSX would cause the SYSX/BILL file to be overwritten with the user's binary. In effect, the compiler is the confused deputy having to reconcile both its own and the user's set of privileges, but unfortunately allows for unintended behavior.
    [Show full text]
  • Site Map - Apache HTTP Server 2.0
    Site Map - Apache HTTP Server 2.0 Apache HTTP Server Version 2.0 Site Map ● Apache HTTP Server Version 2.0 Documentation ❍ Release Notes ■ Upgrading to 2.0 from 1.3 ■ New features with Apache 2.0 ❍ Using the Apache HTTP Server ■ Compiling and Installing Apache ■ Starting Apache ■ Stopping and Restarting the Server ■ Configuration Files ■ How Directory, Location and Files sections work ■ Server-Wide Configuration ■ Log Files ■ Mapping URLs to Filesystem Locations ■ Security Tips ■ Dynamic Shared Object (DSO) support ■ Content Negotiation ■ Custom error responses ■ Setting which addresses and ports Apache uses ■ Multi-Processing Modules (MPMs) ■ Environment Variables in Apache ■ Apache's Handler Use ■ Filters ■ suEXEC Support ■ Performance Hintes ■ URL Rewriting Guide ❍ Apache Virtual Host documentation ■ Name-based Virtual Hosts ■ IP-based Virtual Host Support ■ Dynamically configured mass virtual hosting ■ VirtualHost Examples ■ An In-Depth Discussion of Virtual Host Matching ■ File descriptor limitations ■ Issues Regarding DNS and Apache ❍ Apache Server Frequently Asked Questions http://httpd.apache.org/docs-2.0/sitemap.html (1 of 4) [5/03/2002 9:53:06 PM] Site Map - Apache HTTP Server 2.0 ■ Support ❍ Apache SSL/TLS Encryption ■ SSL/TLS Encryption: An Introduction ■ SSL/TLS Encryption: Compatibility ■ SSL/TLS Encryption: How-To ■ SSL/TLS Encryption: FAQ ■ SSL/TLS Encryption: Glossary ❍ Guides, Tutorials, and HowTos ■ Authentication ■ Apache Tutorial: Dynamic Content with CGI ■ Apache Tutorial: Introduction to Server Side Includes ■ Apache
    [Show full text]
  • December 2010 VOLUME 35 NUMBER 6
    December 2010 VOLUME 35 NUMBER 6 OPINION Musings 2 RikR FaR ow SECURITY Introducing Capsicum: Practical Capabilities for UNIX 7 Robe Rt N.M. watsoN, JoNathaN THE USENIX MAGAZINE aNdeRsoN, beN LauRie, aNd kRis keNNaway The Nocebo Effect on the Web: An Analysis of Fake Anti-Virus Distribution 18 Moheeb abu Ra Jab, Lucas baLLaRd, PaNayiotis MavRoMMatis, NieLs PRovos, aNd XiN Zhao Vulnerable Compliance 26 d aN GeeR Overcoming an Untrusted Computing Base: Detecting and Removing Malicious Hardware Automatically 31 Matthew hicks, MuRPh FiNNicuM, saMueL t. kiNG, MiLo M.k. MaRtiN, aNd JoNathaN M. sMith C OLUMNS Practical Perl Tools: Family Man 42 d avid N. bLaNk-edeLMaN Pete’s All Things Sun: Comparing Solaris to RedHat Enterprise and AIX 48 Petee R ba R GaLviN iVoyeur: Ganglia on the Brain 54 d ave JosePhseN /dev/random 58 Robe Rt G. Fe RReLL BOEO K reVI WS Book Reviews 60 El iZabeth Zwicky et a L. useni X NOTES Thankso t Our Volunteers 64 Ell u ie yo ng CN O FERENCES 19th USENIX Security Symposium Reports 67 Report on the 5th USENIX Workshop on Hot Topics in Security 97 Report on the 1st USENIX Workshop on Health Security and Privacy 103 Report on the 4th USENIX Workshop on Offensive Technologies 112 Report on the New Security Paradigms Workshop 117 The Advanced Computing Systems Association dec10covers.indd 1 11.17.10 1:28 PM Upcoming Events 9th USENIX CoNfErence oN fIlE aNd StoragE 2011 USENIX fEdEratEd CoNfErences Week techNologies (FASt ’11) j une 12–17, 2011, portland, OR, uSa Sponsored by USENIX in cooperation with ACM SIGOPS EventS inclUdE:
    [Show full text]
  • Operating Systems & Virtualisation Security Knowledge Area
    Operating Systems & Virtualisation Security Knowledge Area Issue 1.0 Herbert Bos Vrije Universiteit Amsterdam EDITOR Andrew Martin Oxford University REVIEWERS Chris Dalton Hewlett Packard David Lie University of Toronto Gernot Heiser University of New South Wales Mathias Payer École Polytechnique Fédérale de Lausanne The Cyber Security Body Of Knowledge www.cybok.org COPYRIGHT © Crown Copyright, The National Cyber Security Centre 2019. This information is licensed under the Open Government Licence v3.0. To view this licence, visit: http://www.nationalarchives.gov.uk/doc/open-government-licence/ When you use this information under the Open Government Licence, you should include the following attribution: CyBOK © Crown Copyright, The National Cyber Security Centre 2018, li- censed under the Open Government Licence: http://www.nationalarchives.gov.uk/doc/open- government-licence/. The CyBOK project would like to understand how the CyBOK is being used and its uptake. The project would like organisations using, or intending to use, CyBOK for the purposes of education, training, course development, professional development etc. to contact it at con- [email protected] to let the project know how they are using CyBOK. Issue 1.0 is a stable public release of the Operating Systems & Virtualisation Security Knowl- edge Area. However, it should be noted that a fully-collated CyBOK document which includes all of the Knowledge Areas is anticipated to be released by the end of July 2019. This will likely include updated page layout and formatting of the individual Knowledge Areas KA Operating Systems & Virtualisation Security j October 2019 Page 1 The Cyber Security Body Of Knowledge www.cybok.org INTRODUCTION In this Knowledge Area, we introduce the principles, primitives and practices for ensuring se- curity at the operating system and hypervisor levels.
    [Show full text]
  • Runtime Data Driven Partitioning of Linux Code
    This is the author's version of an article that has been published in this journal. Changes were made to this version by the publisher prior to publication. The final version of record is available at http://dx.doi.org/10.1109/TDSC.2017.2745574 1 How to Fillet a Penguin: Runtime Data Driven Partitioning of Linux Code Oliver Schwahn, Stefan Winter, Nicolas Coppik, and Neeraj Suri Abstract—In many modern operating systems (OSs), there exists no isolation between different kernel components, i.e., the failure of one component can affect the whole kernel. While microkernel OSs introduce address space separation for large parts of the OS, their improved fault isolation comes at the cost of performance. Despite significant improvements in modern microkernels, monolithic OSs like Linux are still prevalent in many systems. To achieve fault isolation in addition to high performance and code reuse in these systems, approaches to move only fractions of kernel code into user mode have been proposed. These approaches solely rely on static code analyses for deciding which code to isolate, neglecting dynamic properties like invocation frequencies. We propose to augment static code analyses with runtime data to achieve better estimates of dynamic properties for common case operation. We assess the impact of runtime data on the decision what code to isolate and the impact of that decision on the performance of such “microkernelized” systems. We extend an existing tool chain to implement automated code partitioning for existing monolithic kernel code and validate our approach in a case study of two widely used Linux device drivers and a file system.
    [Show full text]
  • A Bibliography of O'reilly & Associates and O
    A Bibliography of O'Reilly & Associates and O'Reilly Media. Inc. Publishers Nelson H. F. Beebe University of Utah Department of Mathematics, 110 LCB 155 S 1400 E RM 233 Salt Lake City, UT 84112-0090 USA Tel: +1 801 581 5254 FAX: +1 801 581 4148 E-mail: [email protected], [email protected], [email protected] (Internet) WWW URL: http://www.math.utah.edu/~beebe/ 08 February 2021 Version 3.67 Title word cross-reference #70 [1263, 1264]. #70-059 [1263]. #70-068 [1264]. 2 [949]. 2 + 2 = 5986 [1456]. 3 [1149, 1570]. *# [1221]. .Mac [1940]. .NET [1860, 22, 186, 342, 441, 503, 591, 714, 716, 721, 730, 753, 786, 998, 1034, 1037, 1038, 1043, 1049, 1089, 1090, 1091, 1119, 1256, 1468, 1858, 1859, 1863, 1899, 1900, 1901, 1917, 1997, 2029]. '05 [461, 1532]. 08 [1541]. 1 [1414]. 1.0 [1009]. 1.1 [59]. 1.2 [1582]. 1000 [1511]. 1000D [1073]. 10g [711, 710]. 10th [2109]. 11 [1385]. 1 2 2 [53, 209, 269, 581, 2134, 919, 940, 1515, 1521, 1530, 2023, 2045]. 2.0 [2, 55, 203, 394, 666, 941, 1000, 1044, 1239, 1276, 1504, 1744, 1801, 2073]. 2.1 [501]. 2.2 [201]. 2000 [38, 202, 604, 610, 669, 927, 986, 1087, 1266, 1358, 1359, 1656, 1751, 1781, 1874, 1959, 2069]. 2001 [96]. 2003 [70, 71, 72, 73, 74, 279, 353, 364, 365, 789, 790, 856, 987, 1146, 1960, 2026]. 2003-2013 [1746]. 2004 [1195]. 2005 [84, 151, 755, 756, 1001, 1041, 1042, 1119, 1122, 1467, 2120, 2018, 2056]. 2006 [152, 153]. 2007 [618, 726, 727, 728, 1123, 1125, 1126, 1127, 2122, 1973, 1974, 2030].
    [Show full text]
  • Capsicum Slides
    Capsicum Capability-Based Sandboxing David Drysdale Google UK Features Current LXC uses the following kernel features to contain processes: ● Kernel namespaces (ipc, uts, mount, pid, network and user) ● Apparmor and SELinux profiles ● Seccomp policies ● Chroots (using pivot_root) ● Kernel capabilities ● CGroups (control groups) Agenda ● Ideas ○ Privilege Separation ○ Capabilities ● Capsicum ○ Hybrid with POSIX ○ Application changes ● Linux container features ● Status/Outlook Check Your Privileges ● Drop unnecessary privileges ○ Just because a process starts as root, doesn't have to stay that way Check Your Privileges ● Drop unnecessary privileges ○ Just because a process starts as root, doesn't have to stay that way ● Divide up software according to what privileges are needed ○ E.g. separate media processing from credentials processing Check Your Privileges ● Drop unnecessary privileges ○ Just because a process starts as root, doesn't have to stay that way ● Divide up software according to what privileges are needed ○ E.g. separate media processing from credentials processing ● Examples: ○ OpenSSH: credential checking process ○ Chrome: renderer processes ● Design impact: ○ Do privileged operations first ○ Pass resources down a privilege gradient Capability-Based Security ● Make the privileges that a process holds more explicit Capability-Based Security ● Make the privileges that a process holds more explicit ● Access objects via unforgeable token: the capability ○ Identifies the object ○ Accompanying rights give allowed operations ○ Can only reduce, not increase rights ○ Can pass capabilities around Capability-Based Security ● Make the privileges that a process holds more explicit ● Access objects via unforgeable token: the capability ○ Identifies the object ○ Accompanying rights give allowed operations ○ Can only reduce, not increase rights ○ Can pass capabilities around ● Remove other ways of accessing objects ○ No access by name, i.e.
    [Show full text]