The cake is a lie: privilege rings as a policy resource

  • Authors:

  • Sergey Bratus;Peter C. Johnson;Ashwin Ramaswamy;Sean W. Smith;Michael E. Locasto

  • Affiliations:

  • Dartmouth College, Hanover, NH, USA;Dartmouth College, Hanover, NH, USA;Dartmouth College, Hanover, NH, USA;Dartmouth College, Hanover, NH, USA;George Mason University, Fairfax, VA, USA

  • Venue:
  • Proceedings of the 1st ACM workshop on Virtual machine security
  • Year:
  • 2009

Quantified Score

Hi-index 0.00

Visualization

Abstract

Components of commodity OS kernels typically execute at the same privilege level. Consequently, the compromise of even a single component undermines the trustworthiness of the entire kernel and its ability to enforce separation between user-level processes. Reliably containing the extent of a compromised kernel component is a problem to which few practical solutions exist. While many approaches have been proposed to reduce the need to trust large portions of the kernel, most of these approaches represent exotic reorganizations of the hardware or OS kernel that are either not applicable to commodity systems or are relatively complex and difficult to debug in their own right (e.g., microkernels). We propose simple, natural modifications to commodity---x86---hardware that enable vertical isolation down through the kernel without the use of virtualization or major OS rewrites; specifically, extending and reinterpreting the x86 segmentation mechanism, extending the existing Current Privilege Level and Descriptor Privilege Level fields. We believe our proposal is a compelling alternative to traditional virtualization because the hardware virtualizes permissions, not I/O.