PeX: A Permission Check Analysis Framework for Linux Kernel
PeX: A Permission Check Analysis Framework for Linux Kernel
复制标题
DOI：
--
复制
发表时间：
2019
期刊：
影响因子：
--
通讯作者：
Tong Zhang;Wenbo Shen;Dongyoon Lee;Changhee Jung;Ahmed M. Azab;Ruowen Wang
中科院分区：
文献类型：
--
作者：
Tong Zhang;Wenbo Shen;Dongyoon Lee;Changhee Jung;Ahmed M. Azab;Ruowen Wang
权限检查通过为特权功能提供访问控制，在操作系统安全性中起着至关重要的作用。但是，对于内核开发人员而言，要正确应用新的许可检查并稳定地验证由于内核的较大代码库和复杂性，这尤其具有挑战性。实际上，Linux内核包含数百万行的代码和数百份许可检查，甚至更糟糕的是，其复杂性正在快速增长。本文介绍了Linux的静态权限检查错误检测器PEX，该检测器将内核源代码作为输入，并报告任何丢失，不一致和冗余许可检查。 PEX使用KIRIN（基于内核接口的间接呼叫分析），这是一种新颖，精确且可扩展的间接呼叫分析技术，利用了内核抽象接口中使用的常见编程范例。 PEX在Kirin构建的概要控制流程图上，自动识别所有权限检查，并渗透权限检查和特权功能之间的映射。对于每个特权函数，PEX检查了该功能的所有可能路径，以便在必要时正确执行之前检查该功能。我们在最新的稳定Linux内核v4.18.5上评估了三种类型的权限检查：DISPIONARY访问控制（DAC），功能和Linux安全模块（LSM）。 PEX报告了36个新的许可检查错误，其中14个已由内核开发人员确认。
Permission checks play an essential role in operating system security by providing access control to privileged functionalities. However, it is particularly challenging for kernel developers to correctly apply new permission checks and to scalably verify the soundness of existing checks due to the large code base and complexity of the kernel. In fact, Linux kernel contains millions of lines of code with hundreds of permission checks, and even worse its complexity is fast-growing. This paper presents PeX, a static Permission check error detector for LinuX, which takes as input a kernel source code and reports any missing, inconsistent, and redundant permission checks. PeX uses KIRIN (Kernel InteRface based Indirect call aNalysis), a novel, precise, and scalable indirect call analysis technique, leveraging the common programming paradigm used in kernel abstraction interfaces. Over the interprocedural control flow graph built by KIRIN, PeX automatically identifies all permission checks and infers the mappings between permission checks and privileged functions. For each privileged function, PeX examines all possible paths to the function to check if necessary permission checks are correctly enforced before it is called. We evaluated PeX on the latest stable Linux kernel v4.18.5 for three types of permission checks: Discretionary Access Controls (DAC), Capabilities, and Linux Security Modules (LSM). PeX reported 36 new permission check errors, 14 of which have been confirmed by the kernel developers.