Application Security Support in the Operating System Kernel

Authors: Manigandan Radhakrishnan and Jon A. Solworth

Complete Citation

Manigandan Radhakrishnan and Jon A. Solworth, Application Security Support in the Operating System Kernel, ACM Conference on Information, Computer and Communication Security (AsiaCCS? ), Taipei, Taiwan, March 2006.

Abstract

Application security is typically coded in the application. In kernelSec, we are investigating mechanisms to implement application security in an operating system kernel. The mechanisms are oriented towards providing authorization properties, and this goal drives the design of permissions and protection mechanisms.

The resulting system is dynamic, allowing the set of per- missions for a program to evolve during program execution. This reduces the need for users and applications to be aware of protection mechanism, since the protection mechanism provides the user with more freedom in how they do things. We explore these properties through a number of examples.

KernelSec? also supports a group (role) mechanism which can define constrained groups enabling groups which only grow, only shrink, are constant, are mutually exclusive with other groups, and which allow inheritance. Moreover groups are used to regulate group membership and allow group administration by non-privileged users.

Annotations

Using an LSM and a daemon program the authors created a user authorization system that has the notion of SecurityCards? for permissions. The work is incredibly similar to RBAC and SELINUX, which the users acknowledge, but argue that their mechanisms are simpler, more natural, and more efficient. The authors make a good point, "System-wide security cannot be provided at the application level, and hence can only be provided in the operating system." kernelSec is implemented at two levels:

• Level 1: system specifications level, supports DAC, MAC, and administrative controls and has decidable authorization properties.
• Level 2: enforcement engine, using SecurityCards? , provides the run-time engine which implements the specified protections. Notion of group sets with group permissions. Allow permissions to change based on program actions. Such as: reading a classified file, now the program cannot write to public files.

-- AndrewBlaich - 05 Sep 2007