Securing Monolithic Kernels using Compartmentalization
Fuente:
arXiv
Salvato in:
| Autori principali: | , , , , , |
|---|---|
| Natura: | Preprint |
| Pubblicazione: |
2024
|
| Soggetti: | |
| Accesso online: | |
| Tags: |
Aggiungi Tag
Nessun Tag, puoi essere il primo ad aggiungerne!!
|
| _version_ | 1866914753250590720 |
|---|---|
| author | Lim, Soo Yee Agrawal, Sidhartha Han, Xueyuan Eyers, David O'Keeffe, Dan Pasquier, Thomas |
| author_facet | Lim, Soo Yee Agrawal, Sidhartha Han, Xueyuan Eyers, David O'Keeffe, Dan Pasquier, Thomas |
| contents | Monolithic operating systems, where all kernel functionality resides in a single, shared address space, are the foundation of most mainstream computer systems. However, a single flaw, even in a non-essential part of the kernel (e.g., device drivers), can cause the entire operating system to fall under an attacker's control. Kernel hardening techniques might prevent certain types of vulnerabilities, but they fail to address a fundamental weakness: the lack of intra-kernel security that safely isolates different parts of the kernel. We survey kernel compartmentalization techniques that define and enforce intra-kernel boundaries and propose a taxonomy that allows the community to compare and discuss future work. We also identify factors that complicate comparisons among compartmentalized systems, suggest new ways to compare future approaches with existing work meaningfully, and discuss emerging research directions. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2404_08716 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | Securing Monolithic Kernels using Compartmentalization Lim, Soo Yee Agrawal, Sidhartha Han, Xueyuan Eyers, David O'Keeffe, Dan Pasquier, Thomas Cryptography and Security Operating Systems Monolithic operating systems, where all kernel functionality resides in a single, shared address space, are the foundation of most mainstream computer systems. However, a single flaw, even in a non-essential part of the kernel (e.g., device drivers), can cause the entire operating system to fall under an attacker's control. Kernel hardening techniques might prevent certain types of vulnerabilities, but they fail to address a fundamental weakness: the lack of intra-kernel security that safely isolates different parts of the kernel. We survey kernel compartmentalization techniques that define and enforce intra-kernel boundaries and propose a taxonomy that allows the community to compare and discuss future work. We also identify factors that complicate comparisons among compartmentalized systems, suggest new ways to compare future approaches with existing work meaningfully, and discuss emerging research directions. |
| title | Securing Monolithic Kernels using Compartmentalization |
| topic | Cryptography and Security Operating Systems |
| url | https://arxiv.org/abs/2404.08716 |