Please use this identifier to cite or link to this item:
https://doi.org/10.21256/zhaw-18635| Publication type: | Conference paper |
| Type of review: | Peer review (publication) |
| Title: | Downright : a framework and toolchain for privilege handling |
| Authors: | Neuhaus, Stephan Schweizer, Remo |
| et. al: | No |
| DOI: | 10.1109/SecDev.2019.00019 10.21256/zhaw-18635 |
| Published in: | Proceedings of the IEEE |
| Proceedings: | Proceedings of the 2019 IEEE Secure Development (SecDev) Conference |
| Conference details: | IEEE SecDev 2019, McLean, USA, 25 - 27 September 2019 |
| Issue Date: | 2019 |
| Publisher / Ed. Institution: | IEEE |
| ISBN: | 978-1-5386-7289-1 |
| ISSN: | 0018-9219 |
| Language: | English |
| Subjects: | Security; Privileges; Linux; Unix |
| Subject (DDC): | 005: Computer programming, programs and data |
| Abstract: | We propose Downright, a novel framework based on Seccomp, Berkeley Packet Filter, and PTrace, that makes it possible to equip new and existing C applications with a request broker architecture. An extensive configuration language allows AppArmor-like configuration that supports programmers in building rules for system call parameter validation and result sanitization. Access to these privileged function calls can be restricted both within Linux kernel and user spaces. Downright's main strength compared to related approaches is that it implements a complete mediation request broker architecture, in which all system calls are vetted before execution, either by the kernel or by a request broker, which runs as another process. This isolates the main program from many failures due to programming bugs and attacks, which would have to pass not only the attacked program, but the request broker also. We argue that this makes acquiring and releasing elevated privileges easier and safer. Downright eliminates the need to write Seccomp programs, instead allowing policies to be expressed declaratively through a rich policy language. We demonstrate the viability of this approach by instrumenting nginx, an industrial-strength web server and reverse proxy. While this instrumentation takes only a single line of code, we argue that even this effort can be avoided by suitable C runtime code. We show that Downright's overhead is substantial, halving nginx's perfomance, but propose measures for optimisation. |
| Further description: | © 2019 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works. |
| URI: | https://digitalcollection.zhaw.ch/handle/11475/18635 |
| Fulltext version: | Accepted version |
| License (according to publishing contract): | Licence according to publishing contract |
| Departement: | School of Engineering |
| Organisational Unit: | Institute of Computer Science (InIT) |
| Appears in collections: | Publikationen School of Engineering |
Show full item record
Neuhaus, S., & Schweizer, R. (2019). Downright : a framework and toolchain for privilege handling. Proceedings of the IEEE. https://doi.org/10.1109/SecDev.2019.00019
Neuhaus, S. and Schweizer, R. (2019) ‘Downright : a framework and toolchain for privilege handling’, in Proceedings of the IEEE. IEEE. Available at: https://doi.org/10.1109/SecDev.2019.00019.
S. Neuhaus and R. Schweizer, “Downright : a framework and toolchain for privilege handling,” in Proceedings of the IEEE, 2019. doi: 10.1109/SecDev.2019.00019.
NEUHAUS, Stephan und Remo SCHWEIZER, 2019. Downright : a framework and toolchain for privilege handling. In: Proceedings of the IEEE. Conference paper. IEEE. 2019. ISBN 978-1-5386-7289-1
Neuhaus, Stephan, and Remo Schweizer. 2019. “Downright : A Framework and Toolchain for Privilege Handling.” Conference paper. In Proceedings of the IEEE. IEEE. https://doi.org/10.1109/SecDev.2019.00019.
Neuhaus, Stephan, and Remo Schweizer. “Downright : A Framework and Toolchain for Privilege Handling.” Proceedings of the IEEE, IEEE, 2019, https://doi.org/10.1109/SecDev.2019.00019.
Items in DSpace are protected by copyright, with all rights reserved, unless otherwise indicated.