Analyzing Capsicum for Usability and Performance Benjamin Farley December 23, 2010 Abstract applications knows, security is also a very dif- ficult problem to solve. Cyber attacks target In this paper I investigate Capsicum, an ex- software applications, or hardware, which are tension to UNIX that introduces a new se- made and designed by programmers; thus, curity model on top of existing UNIX archi- the security of an application is only as good tecture. This model consists of several new as the developer can make it. For simple ap- security primitives and system calls that re- plications and programmers experienced in place existing UNIX functionality. I focus on security, making a program secure is usu- two aspects of Capsicum: performance and ally a reasonable task. However, the diffi- usability. For performance, I compare the culty of this problem increases very quickly performance of Capsicum system calls to cor- as software evolves and grows. As an appli- responding UNIX calls and analyze these dif- cation becomes bigger and more complex, it ferences. I also implement a small file-hosting becomes increasingly difficult to understand server that makes use of Capsicum's sandbox- it and determine how it will behave in a given ing library, in order to determine the feasi- situation. For especially large systems such bility of writing new applications using Cap- as operating system kernels, which can reach sicum and modifying existing applications to millions of lines of code and are developed use Capsicum. and supported by a large group of people, many of which are not well-versed in security, this problem becomes nearly impossible. 1 Introduction For these reasons, it is important that the Computer security is becoming an increas- security primitives provided by a system be ingly important problem in today's world. able to take into account today's vastly com- Viruses, worms, trojans and every other type plex software. In this work, I analyze a new of malware imaginable continue to propogate, system, Capsicum [6], with that goal in mind. despite the industry's best efforts to eradicate In particular, I will focus on two aspects of them. Furthermore, with recent large-scale the system: performance and usability. For attacks such as Stuxnet [2] and the 2008 de- performance, I measure the how long it takes nial of service attack on Georgia, cyber war- various system calls to complete when used in fare is becoming a threat we must take into capability mode versus in normal mode and account when we design systems. Unfortu- analyze the differences I find. I also com- nately, as virtually any user or developer of pare the performance of Capsicum calls to 1 corresponding UNIX calls. Finally, I create cusses the problem of instrumenting complex, a basic server application and instrument it large programs with a small set of small se- using Capsicum in order to understand how curity primitives in order to achieve a given usable it is from an outside perspective and high-level security policy. what changes need to be made to a normal application to let it make use of Capsicum functionality. 3 Capsicum The remainder of this paper is organized as follows. Section 2 gives account of related Capsicum is a UNIX extension that pro- work. Section 3 gives a brief overview of Cap- vides a new security model on top of existing sicum's security model and the functionality UNIX architecture. The basis for this model it provides. In Section 4 I discuss the imple- is the idea of a capability. A capability is mentation of a real world application using an unforgeable token of authority which can Capsicum. Results are discussed in Section be passed around between processes and is 5. Section 6 talks about some of the limita- used to access resources. A capability can tions I found in Capsicum and places where be thought of as an extension, or a wrap- it could be improved. Finally, Section 7 gives per, for basic UNIX file descriptors; it pro- my conclusions. vides the same functionality they do and is used in much the same way, but also pro- vides additional security and a fine-grained 2 Related work measure of control over the resource. For example, whereas traditionally one opens a Object capability systems have been used file with simple read or write privileges, Cap- in previous systems. For example, Google sicum provides over sixty options for speci- Caja [5] uses an object-capability model to fying precisely how the resource will be used attempt to secure JavaScript and online web (including things like read, write, seek, fstat, browsing. It does so by creating and pass- etc). ing around objects which grant access to re- One of the reasons Capsicum is relevant sources like web services. It also includes to this work is that capabilities provide an functionality to rewrite existing JavaScript intuitive, powerful method of implementing programs to use capabilities. In [4], the security. In a capability system, holding a authors analyze the security aspects of this capability is sufficient to allow access to a re- capability-oriented security model. Wedge [1] source. What this means is that once a pro- uses a security model similar to the capabili- cess holds a capability for a given resource, ties that Capsicum uses, but also includes the the system does not need to do any additional improved functionality of being able to con- security checks to make sure that the process trol access to parts of memory on the heap. can access that resource; the fact that the Harris [3] discusses instrumenting existing process has the capability means that it can programs for use in Flume, an OS based access that resource. Conversely, if a process on the idea of decentralized information flow cannot access a resource it will not even know control (DIFC). In this system, security is about the existence of said resource. achieved by controlling how information can This is a useful property for several reasons. flow between entities in a system. Harris dis- In terms of performance, it means that the 2 only time a process needs to take the time to cess only their own files. They could not ac- do security checks is when a resource is first cess the files of other clients, and could not acquired. Thus, if any time-consuming checks see any of the filesystem except their own di- do need to be done, they will usually be a rectory. In this model, I make the assumption one-time cost. Once a process has obtained that workers are untrusted processes. Thus, the resources it needs, they should behave the we can assume that a worker thread may be same way as normal file descriptors. In terms compromised but if it is, the security pol- of programmer usability, this means that, for icy of the system still must not be violated. most intents and purposes, a capability can The implementation of this server in a normal simply be used as if it were a file descriptor. setting is straightforward, and works pretty It will be acquired using Capsicum-specific much exactly how you would expect it to. syntax, but after that the developer and the The flow of events is summarized in Figure application interact with it the same way they 1. The server accepts incoming connections would with a normal file descriptor. from clients and spawns a worker thread to The other main primitive Capsicum pro- deal with each request it receives. After the vides is capability mode. Capability mode is initial request, most interaction occurs be- denoted by a simple process credential flag, tween the client and the worker. The only which processes can set through a new sys- aspect of my implementation that may be tem call, cap enter. Once in capability mode, slightly surprising is that the server spawns a process has limited access to global names- threads upon receiving requests, rather than paces such as the file system or the PID using a thread pool. Since thread pools are namespace. This means it cannot access files often a better solution for client/server needs, and has limited ability to communicate with it seems that it would make more sense to use other processes. However, a process inherits this in my implementation. Unfortunately, capabilities that it held before entering capa- it turns out that, due to limitations in Cap- bility mode, as well as ones its parent process sicum, a thread pool does not work well for held. this particular scenario. This will be dis- Finally, the developers of Capsicum pro- cussed further in Section 6. vided their own library, libcapsicum, that uses the above to provide higher level func- From here, I used libcapsicum to instru- tionality, with a focus on sandboxing. This ment this server to use Capsicum's security library was what I used to instrument my ex- functionality. In doing this, I hoped to un- ample program, and as such will be the focus derstand what changes need to be made to a of my evaluation. normal program to get it to work with Cap- sicum, and to analyze how usable Capsicum is for developers from an outside perspective. 4 Implementation I also wanted to determine what kind of per- formance difference a real world application To evaluate Capsicum on the above criteria, I would experience when using Capsicum. Fig- wrote a basic file-hosting server. This server ure 2 shows the flow of the modified server. lets clients store and access files in a secure As the diagrams show, the instrumented ap- manner. Specifically, the security policy I plication runs much the same way as the orig- chose to implement was that clients could ac- inal.