LXDs: Towards Isolation of Kernel Subsystems
LXDs: Towards Isolation of Kernel Subsystems
复制标题
DOI：
--
复制
发表时间：
2019
期刊：
影响因子：
--
通讯作者：
Vikram Narayanan;Abhiram Balasubramanian;Charles Jacobsen;Sarah Spall;Scotty Bauer;Michael Quigley;Aftab Hussain;Abdullah Younis;Junjie Shen;Moinak Bhattacharyya;A. Burtsev
中科院分区：
文献类型：
--
作者：
Vikram Narayanan;Abhiram Balasubramanian;Charles Jacobsen;Sarah Spall;Scotty Bauer;Michael Quigley;Aftab Hussain;Abdullah Younis;Junjie Shen;Moinak Bhattacharyya;A. Burtsev
现代操作系统是整体的。但是，如今，缺乏孤立是破坏内核安全性的主要因素之一。内核代码和快速开发速度的固有复杂性结合使用不安全的低级编程语言会导致稳定的错误流。即使经过数十年的努力使商品内核更加安全，即开发旨在防止剥削最常见错误的众多静态和动态方法，每年都有数百个严重的内核漏洞。不幸的是，在整体内核中，单个可剥削的脆弱性可能为攻击者提供了访问整个内核的访问。现代内核需要隔离，作为将利用效果限制在各个内核子系统上的实际手段。从历史上看，在内核中引入隔离是很难的。首先，商品硬件界面没有为高效，细粒度的隔离提供支持。其次，现代内核的复杂性阻止了幼稚的分解努力。我们在轻型执行域（LXDS）上的工作朝着在功能齐全的操作系统内核中隔离迈出了一步。 LXD允许一个人使用现有的内核子系统，并将其运行在隔离域中，并以最小的或没有修改，并且开销最少。我们通过开发Linux内核中的几个至关重要的设备驱动程序的孤立版本来评估我们的方法。
Modern operating systems are monolithic. Today, however, lack of isolation is one of the main factors undermining security of the kernel. Inherent complexity of the kernel code and rapid development pace combined with the use of unsafe, low-level programming language results in a steady stream of errors. Even after decades of efforts to make commodity kernels more secure, i.e., development of numerous static and dynamic approaches aimed to prevent exploitation of most common errors, several hundreds of serious kernel vulnerabilities are reported every year. Unfortunately, in a monolithic kernel a single exploitable vulnerability potentially provides an attacker with access to the entire kernel. Modern kernels need isolation as a practical means of confining the effects of exploits to individual kernel subsystems. Historically, introducing isolation in the kernel is hard. First, commodity hardware interfaces provide no support for efficient, fine-grained isolation. Second, the complexity of a modern kernel prevents a naive decomposition effort. Our work on Lightweight Execution Domains (LXDs) takes a step towards enabling isolation in a full-featured operating system kernel. LXDs allow one to take an existing kernel subsystem and run it inside an isolated domain with minimal or no modifications and with a minimal overhead. We evaluate our approach by developing isolated versions of several performance-critical device drivers in the Linux kernel.