Verifying the Reliability of Operating System-Level Information Flow Control Systems in Linux

Abstract

International audienceInformation Flow Control at Operating System (OS) level features interesting properties and have been an active topic of research for years. However, no implementation can work reliably if there does not exist a way to correctly and precisely track all information flows occurring in the system. The existing implementations for Linux are based on the Linux Security Modules (LSM) framework which implements hooks at speciic points in code where any security mechanism may interpose a security decision in the execution. However, previous works on the verification of LSM only addressed access control and no work has raised the question of the reliability of information flow control systems built on LSM. In this work, we present a compiler-assisted and reproducible static analysis on the Linux kernel to verify that the LSM hooks are correctly placed with respect to operations generating information flows so that LSM-based information flow monitors can properly track all information flows. Our results highlight flaws in LSM that we propose to solve, thus improving the suitability of this framework for the implementation of information flow monitors

Unicorn: Runtime Provenance-Based Detector for Advanced Persistent Threats

“…We use CamFlow [100] as the reference implementation throughout the paper, although there exist other whole-system provenance implementations; in § VI, we show that UNI-CORN works seamlessly with other capture mechanisms as well. CamFlow adopts the Linux Security Modules (LSM) framework [89] to ensure high-quality, reliable recording of information flows among data objects [45], [101]. LSM eliminates race conditions (e.g., TOCTTOU attacks) by placing mediation points inside the kernel instead of at the system call interface [61].…”

Runtime Analysis of Whole-System Provenance

“…We built CamQuery on top of the CamFlow provenance capture system [3,79,80], our actively-maintained provenance monitor built as a stackable Linux Security Module (LSM) [69]. Compared to other existing capture techniques [34,72], an LSM-based approach ensures that CamFlow can observe and mediate all information flows between processes and kernel objects [27,31,36,51] (see § 4.2 for further discussion).…”

“…The LSM framework [69] was originally implemented to support Mandatory Access Control (MAC) schemes but not information flow tracking. Recent work by Georget et al [35,36] demonstrated, through static analysis of the kernel code base, that the LSM framework is applicable to information flow tracking, and that by adding a small number of LSM hooks, it was possible to properly intercept all information flows between kernel objects. Building on their work, we maintain a patch [5] to the LSM framework that allows CamFlow, and by extension CamQuery, to provide stronger guarantees than do previous whole-system provenance capture mechanisms.…”

Information Flow Tracking for Linux Handling Concurrent System Calls and Shared Memory

“…We have leveraged the expertise from our previous work on LSM [3] to map our model onto the LSM framework. Some flows cannot possibly enter in a race condition with others and require no disabling hook.…”

“…In a previous work [3], we have developed an approach to verify that LSM hooks were available in each system call generating an information flow, so that an information flow tracker could monitor all of them. This is a necessary condition to implement a correct information flow tracker.…”