Nested Kernel
Autor: | Will Dietz, Theodoros Kasampalis, John Criswell, Nathan Dautenhahn, Vikram Adve |
---|---|
Rok vydání: | 2015 |
Předmět: |
Software_OPERATINGSYSTEMS
procfs sysfs Computer science Scheduler activations Kernel virtual address space General Medicine computer.software_genre Computer Graphics and Computer-Aided Design Monolithic kernel Configfs Kernel preemption Process control block Fork (system call) Virtual memory Operating system Hybrid kernel computer Software |
Zdroj: | ASPLOS |
ISSN: | 0163-5964 |
Popis: | Monolithic operating system designs undermine the security of computing systems by allowing single exploits anywhere in the kernel to enjoy full supervisor privilege. The nested kernel operating system architecture addresses this problem by "nesting" a small isolated kernel within a traditional monolithic kernel. The "nested kernel" interposes on all updates to virtual memory translations to assert protections on physical memory, thus significantly reducing the trusted computing base for memory access control enforcement. We incorporated the nested kernel architecture into FreeBSD on x86-64 hardware while allowing the entire operating system, including untrusted components, to operate at the highest hardware privilege level by write-protecting MMU translations and de-privileging the untrusted part of the kernel. Our implementation inherently enforces kernel code integrity while still allowing dynamically loaded kernel modules, thus defending against code injection attacks. We also demonstrate that the nested kernel architecture allows kernel developers to isolate memory in ways not possible in monolithic kernels by introducing write-mediation and write-logging services to protect critical system data structures. Performance of the nested kernel prototype shows modest overheads |
Databáze: | OpenAIRE |
Externí odkaz: |