Practical Fine-Grained Information Flow Control Using Laminar

Abstract

Decentralized Information Flow Control (DIFC) is a promising model for writing programs with powerful, end-to-end security guarantees. Current DIFC systems that run on commodity hardware can be broadly categorized into two types: language-level and operating system-level DIFC. Language solutions provide no guarantees against security violations on system resources such as files and sockets. Operating system solutions mediate accesses to system resources but are either inefficient or imprecise at monitoring the flow of information through fine-grained program data structures. This article describes Laminar, the first system to implement DIFC using a unified set of abstractions for OS resources and heap-allocated objects. Programmers express security policies by labeling data with secrecy and integrity labels and access the labeled data in security methods. Laminar enforces the security policies specified by the labels at runtime. Laminar is implemented using a modified Java virtual machine and a new Linux security module. This article shows that security methods ease incremental deployment and limit dynamic security checks by retrofitting DIFC policies on four application case studies. Replacing the applications' ad hoc security policies changes less than 10% of the code and incurs performance overheads from 5% to 56%. Compared to prior DIFC systems, Laminar supports a more general class of multithreaded DIFC programs efficiently and integrates language and OS abstractions.

Camflow: Managed Data-Sharing for Cloud Services

“…Some previous work [14], [28] allows implicit declassification and endorsement. That is, if an active entity has the privilege to declassify/endorse and the privilege to return to its original state (i.e.…”

“…However, for most applications, the overhead is imperceptible and lost in system noise; it is hard to measure without using kernel 3. It is not feasible to provide a comparison with the Laminar implementation [28], that is closest in technical terms to our work, as the implementation available https://github.com/ut-osa/laminar is for an obsolete kernel version 2.6.22 (07/2007). tools, as the variation between two executions may be greater than the overhead.…”

Information Flow Audit for PaaS Clouds

“…A newly created entity inherits the security context of its parent. Though other implementations [16], [22] allow more flexibility, they modify system call semantics, and therefore require applications to be rewritten [10]. Creation of an entity represents a flow of information between the parent and the child entity.…”

“…Enforcing IFC in a database, for example, would require a specific database implementation, such as IFDB [27], where IFC would be enforced at a finer granularity than at the kernelobject level. Different levels of IFC enforcement can be made to interact gracefully, as in [22] or through means described in §IV-C. As IFC mechanisms are made to interoperate, an API should be provided for (internal) IFA to complement systemwide audit data. Similarly, the metadata collected will vary, according to the IFC enforcement mechanism(s), the applications involved, and higher-level provenance requirements [25].…”

Information Flow Tracking for Linux Handling Concurrent System Calls and Shared Memory

“…Consider the situation presented here: left to right in the example, we see that the taint from the file is propagated to cp and then to the copy and wc, and eventually to /dev/stdout. The focus of this article is on three IFC systems developed for the generic Linux kernel: KBlare [4], Laminar [11,9], and the Android Linux kernel: Weir [8].…”