Automatic source code decomposition for privilege separation

Trapp, Markus; Rossberg, Michael; Schaefer, Guenter

doi:10.1109/softcom.2016.7772123

Cited by 3 publications

(1 citation statement)

References 4 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…SPL|T handles this problem and circumvents it by adding a configuration file and a statistical code analysis [17]. It provides a further solution to the problem when privileged parts call functions mutually.…”

Section: B Privilege Separationmentioning

confidence: 99%

Downright: A Framework and Toolchain for Privilege Handling

Schweizer

Neuhaus

2019

2019 IEEE Cybersecurity Development (SecDev)

View full text Add to dashboard Cite

We propose Downright, a novel framework based on Seccomp, Berkeley Packet Filter, and PTrace, that makes it possible to equip new and existing C applications with a request broker architecture. An extensive configuration language allows AppArmor-like configuration that supports programmers in building rules for system call parameter validation and result sanitization. Access to these privileged function calls can be restricted both within Linux kernel and user spaces. Downright's main strength compared to related approaches is that it implements a complete mediation request broker architecture, in which all system calls are vetted before execution, either by the kernel or by a request broker, which runs as another process. This isolates the main program from many failures due to programming bugs and attacks, which would have to pass not only the attacked program, but the request broker also. We argue that this makes acquiring and releasing elevated privileges easier and safer. Downright eliminates the need to write Seccomp programs, instead allowing policies to be expressed declaratively through a rich policy language. We demonstrate the viability of this approach by instrumenting nginx, an industrial-strength web server and reverse proxy. While this instrumentation takes only a single line of code, we argue that even this effort can be avoided by suitable C runtime code. We show that Downright's overhead is substantial, halving nginx's perfomance, but propose measures for optimisation.

show abstract

Section: B Privilege Separationmentioning

confidence: 99%