Information Flow Control For Standard OS Abstractions Max Krohn, - - PowerPoint PPT Presentation

▶
information flow control for standard os abstractions
SMART_READER_LITE
LIVE PREVIEW

Information Flow Control For Standard OS Abstractions Max Krohn, - - PowerPoint PPT Presentation

Jul 19, 2023 181 likes •674 views

Information Flow Control For Standard OS Abstractions Max Krohn, Alex Yip, Micah Brodsky, Natan Cliffer, Frans Kaashoek, Eddie Kohler, Robert Morris Vulnerabilities in Websites Exploits Web software is buggy Attackers find and

slide-1
SLIDE 1

Information Flow Control For Standard OS Abstractions

Max Krohn, Alex Yip, Micah Brodsky, Natan Cliffer, Frans Kaashoek, Eddie Kohler, Robert Morris

slide-2
SLIDE 2

Vulnerabilities in Websites  Exploits

  • Web software is buggy
  • Attackers find and exploit these bugs
  • Data is stolen / Corrupted

– “USAJobs.gov hit by Monster.com attack, 146,000 people affected” – “UN Website is Defaced via SQL Injection” – “Payroll Site Closes on Security Worries” – “Hacker Accesses Thousands of Personal Data Files at CSU Chico” – “FTC Investigates PETCO.com Security Hole” – “Major Breach of UCLA’s Computer Files” – “Restructured Text Include Directive Does Not Respect ACLs”

slide-3
SLIDE 3

Decentralized Information Flow Control (DIFC)

Layoff Plans Free TShirts Web App Web App Declassifier CEO

P

Intern

slide-4
SLIDE 4

Decentralized Information Flow Control (DIFC)

Layoff Plans Free TShirts Web App Web App Declassifier CEO Intern /tmp File Helper Process

slide-5
SLIDE 5

Why is DIFC a cult?

slide-6
SLIDE 6

Who Needs to Understand DIFC?

Layoff Plans Free TShirts Web App Web App Declassifier CEO Intern /tmp File Helper Process

slide-7
SLIDE 7

Why is Today’s DIFC DIFfiCult?

  • Label systems are complex
  • Unexpected program behavior
  • Cannot reuse existing code

– Drivers, SMP support, standard libraries

slide-8
SLIDE 8

Unexpected Program Behavior (Unreliable Communication)

Process q Process p

“I stopped reading” “I crashed”

P

“Fire Alice, Bob, Charlie, Doug, Eddie, Frank, George, Hilda, Ilya…”

slide-9
SLIDE 9

Unexpected Program Behavior (Mysterious Failures)

Process p Process q File

slide-10
SLIDE 10

Solution/Outline

  • 1. Flume: Solves DIFC Problems

– User-level implementation of DIFC on Linux – Simple label system – Endpoints: Glue Between Unix API and Labels

  • 2. Application + Evaluation

– Real Web software secured by Flume

slide-11
SLIDE 11

Outline

  • 1. Flume: Solves DIFC Problems

– User-level implementation of DIFC on Linux – Simple label system – Endpoints: Glue Between Unix API and Labels

  • 2. Application + Evaluation
slide-12
SLIDE 12

Flume Implementation

  • Goal: User-level implementation

– apt-get install flume

  • Approach:

– System Call Delegation [Ostia by Garfinkel et al, 2003] – Use Linux 2.6 (or OpenBSD 3.9)

slide-13
SLIDE 13

System Call Delegation

Web App glibc

Linux Kernel

Layoff Plans

  • pen(“/hr/LayoffPlans”, O_RDONLY);
slide-14
SLIDE 14

System Call Delegation

Web App Flume Libc

Linux Kernel

Layoff Plans

  • pen(“/hr/LayoffPlans”, O_RDONLY);

Flume Reference Monitor Web App

slide-15
SLIDE 15

Three Classes of Processes

Flume Reference Monitor Linux Kernel Process p Flume Reference Monitor Linux Kernel Process p Flume Reference Monitor Linux Kernel Process p

Flume-Oblivious Unconfined/ Mediators Confined

slide-16
SLIDE 16

Outline

  • 1. Flume: Solves DIFC Problems

– User-level implementation of DIFC on Linux – Simple label system – Endpoints: Glue Between Unix API and Labels

  • 2. Application + Evaluation
slide-17
SLIDE 17

Information Flow Control (IFC)

  • Goal: track which secrets a process has seen
  • Mechanism: each process gets a secrecy label

– Label summarizes which categories of data a process is assumed to have seen. – Examples:

  • { “Financial Reports” }
  • { “HR Documents” }
  • { “Financial Reports” and “HR Documents” }

“tag” “label”

slide-18
SLIDE 18

Tags + Labels

Process p

tag_t HR = create_tag(); Sp = {} Dp = {} Dp = { HR } Universe of Tags:

Finance Legal SecretProjects

change_label({Finance}); Sp = { Finance } Sp = { Finance, HR } HR change_label({Finance,HR}); change_label({Finance}); change_label({});

DIFC: Declassification in action. Same as Step 1. Any process can add any tag to its label. DIFC Rule: A process can create a new tag; gets ability to declassify it.

slide-19
SLIDE 19

Communication Rule

Process q Process p

Sq = { HR, Finance } Sp = { HR } P

p can send to q iff Sp Sq

slide-20
SLIDE 20

Outline

  • 1. Flume: Solves DIFC Problems

– User-level implementation of DIFC on Linux – Simple label system – Endpoints: Glue Between Unix API and Labels

  • 2. Application + Evaluation
slide-21
SLIDE 21

Recall: Communication Problem

Process p

stdin stdout

“Fire Alice, Bob, Charlie, Doug, Eddie, Frank, George, Hilda, Ilya…” “SLOW DOWN!!” “I crashed” P

Sq = { HR }

?

Sp = {} Dp = { HR }

Process q

slide-22
SLIDE 22

New Abstraction: Endpoints

f

Sf = { HR } Se = { HR } Process q Process p

Sp = {} Dp = { HR }

e

  • If Se

Sf , then allow e to send to f

  • If Sf

Se , then allow f to send to e

  • If Sf = Se , then allow bidirectional flow

Sq = { HR }

“Fire Alice, Bob, Charlie, Doug, Eddie, Frank, George, Hilda, Ilya…” “SLOW DOWN!!” “I crashed” P

P

slide-23
SLIDE 23

Thus p needs HR Dp

Endpoints Declassify Data

Data enters process p with secrecy { HR } But p keeps its label Sp = {}

Se = { HR } Process p

Sp = {} Dp = { HR }

e

slide-24
SLIDE 24

Endpoint Invariant

  • For any tag t

Sp and t Se

  • Or any tag t

Se and t Sp

  • It must be that t

Dp

Process p

e

Sp = { Finance } Se = { HR } Dp = { Finance, HR} Writing Reading

slide-25
SLIDE 25

Endpoints Labels Are Independent

f g

Sf = { HR }

Sg = {}

Se = { HR } Process q Process p

Sq = { HR } Sp = {} Dp = { HR }

e

slide-26
SLIDE 26

Recall: Mysterious Failures

Process p File Process q

slide-27
SLIDE 27

Endpoints Reveal Errors Eagerly

Process p

Sp = {}

/tmp/public.dat

Spublic.dat = {}

open(“/tmp/public.dat”, O_WRONLY); change_label({HR})

e

Se = {}

Process q

Sq = { HR } Dp = {} Sp = { HR }

? Violates endpoint invariant!

Sp – Se = { HR } Dp

slide-28
SLIDE 28

Endpoints Reveal Errors Eagerly

Process p

Sp = {}

/tmp/public.dat

Spublic.dat = {}

fd = open(“/tmp/public.dat”, O_WRONLY); close(fd); change_label({HR})

e

Se = {}

Process q

Sq = { HR } Dp = {} Sp = { HR }

slide-29
SLIDE 29

Outline

  • 1. Flume: Solves DIFC Problems
  • 2. Application + Evaluation
slide-30
SLIDE 30

Questions for Evaluation

  • Does Flume allow adoption of Unix software?
  • Does Flume solve security vulnerabilities?
  • Does Flume perform reasonably?
slide-31
SLIDE 31

Example App: MoinMoin Wiki

slide-32
SLIDE 32

How Problems Arise…

MoinMoin Wiki (100 kLOC)

FreeTShirts LayoffPlans

if not self.request.user.may.read(pagename): return self.notAllowedFault()

x43

slide-33
SLIDE 33

MoinMoin + DIFC

Apache Web Server MoinMoin Wiki (100 kLOC)

FreeTShirts LayoffPlans Declassifier 1 kLOC

Untrusted Trusted

slide-34
SLIDE 34

FlumeWiki

Apache MoinMoin (100 kLOC)

FreeTShirts LayoffPlans Declassifier 1 kLOC Web Client GET /LayoffPlans?user=Intern&PW=abcd S={} S={ HR }

reliable IPC file I/O

Flume- Oblivious unconfined confined

slide-35
SLIDE 35

Future Work

Apache Totally Suspect Software

FreeTShirts LayoffPlans Declassifier 1 kLOC Web Client GET /LayoffPlans?user=Intern&PW=abcd S={} S={ HR }

slide-36
SLIDE 36

Results

  • Does Flume allow adoption of Unix software?

– 1,000 LOC launcher/declassifier – 1,000 out of 100,000 LOC in MoinMoin changed – Python interpreter, Apache, unchanged

  • Does Flume solve security vulnerabilities?

– Without our knowing, we inherited two ACL bypass bugs from MoinMoin – Both are not exploitable in Flume’s MoinMoin

  • Does Flume perform reasonably?

– Performs within a factor of 2 of the original on read and write benchmarks

slide-37
SLIDE 37

Most Related Work

  • Asbestos, HiStar: New DIFC OSes
  • Jif: DIFC at the language level
  • Ostia, Plash: Implementation techniques
  • Classical MAC literature (Bell-LaPadula, Biba,

Orange Book MAC, Lattice Model, etc.)

slide-38
SLIDE 38

Limitations

  • Bigger TCB than HiStar / Asbestos

– Linux stack (Kernel + glibc + linker) – Reference monitor (~22 kLOC)

  • Covert channels via disk quotas
  • Confined processes like MoinMoin don’t get

full POSIX API.

– spawn() instead of fork() & exec() – flume_pipe() instead of pipe()

slide-39
SLIDE 39

Summary

  • DIFC is a challenge to Programmers
  • Flume: DIFC in User-Level

– Preserves legacy software – Complements today’s programming techniques

  • MoinMoin Wiki: Flume works as promised
  • Invite you to play around:

http://flume.csail.mit.edu

slide-40
SLIDE 40

Thanks!

To: ITRI, Nokia, NSF and You

slide-41
SLIDE 41

Reasons to Read the Paper

  • Generalized security properties

– Including: Novel integrity policies

  • Support for very large labels
  • Support for clusters of Flume Machines
slide-42
SLIDE 42

Flume’s Rule is Fast

  • Recall:

p can send to q iff: Sp – Dp Sq Dq

  • To Compute:

– for each tag t Sp:

  • If t

Sq and t Dp and t Dq: –output “NO” – output “OK”

  • Runs in time proportional to size of Sp.
  • No need to enumerate Dp or Dq !!!
slide-43
SLIDE 43

Flume Communication Rule

  • 1. q changes to Sq = { Alice }
  • 2. p sends to q
  • 3. q changes back to Sq= {}

MoinMoin (r) MoinMoin (p)

Sr = { Bob } Sp = { Alice }

Database (q)

Sq = {} Dq = { Alice, Bob }

? ?

Sp Sq

Sq = { Alice } Dq = { Alice, Bob }

P

slide-44
SLIDE 44

Flume Communication Rule

MoinMoin (r) MoinMoin (p)

Sr = { Bob } Sp = { Alice }

Database (q)

Sq = {} Dq= { Alice, Bob }

P P

Senders get extra latitude Receivers get extra latitude

  • p can send to q iff:

– In IFC: Sp Sq – In Flume: Sp – Dp Sq Dq

slide-45
SLIDE 45

Flume Kernel Module

Flume Kernel Module

Flume Libc

Linux Kernel

Alice’s Data

  • pen(“/alice/inbox.dat”, O_RDONLY);

Flume Reference Monitor Web App mov $0x5, %eax int $0x80

  • pen(…)

P

slide-46
SLIDE 46

Reference Monitor Proxies Pipes Linux Kernel

write(0, “some data”, 10);

Flume Reference Monitor Web App Helper Process

slide-47
SLIDE 47

Unconfined Processes

sendmail

mmap’ed memory fork’ed child kill e Se = {} /tmp/public.dat

Spublic.dat = {} Sp = {} Dp = {}

Process q

Sq = { HR }

DIFC

“Unconfined processes get e endpoint.” change_label({HR})

Dp = { HR } Sp = { HR }

P P

slide-48
SLIDE 48

Endpoints Reveal Errors Eagerly

Process p

Sp = {}

/tmp/public.dat

Spublic.dat = {}

open(“/tmp/public.dat”, O_WRONLY); change_label({HR})

e

Se = {}

Process q

Sq = { HR } Dp = {HR} Sp = { HR }

P P

slide-49
SLIDE 49

Why Do We Need Sp?

Process p

e

Sp = { Finance } Se = { Finance, HR } Dp = { HR }