Compartmentalisation models
summary
Proposes enforcing least privilege by treating each dynamic library as a compartment and modifying the runtime linker to insert a trampoline for every cross-library call, plus per-compartment stacks and a modified calling convention (varargs placed in a caller-owned buffer). Kernel syscalls are forced through libc hooks for policy checks and dynamic linkage policies like compute only are supported. Prototype runs grpc streaming benchmarks with roughly 10% overhead normally, and grouping related libraries into compartments cuts that overhead substantially; C++ exceptions and some transitions remain work in progress.
AI-written summary · about
chapters (9)
- 0:00Library-based compartmentalisation
- 1:26Threat model for compartmentalisation
- 3:57Library-based approach
- 7:52Privilege gains in code
- 12:36Implementation details
- 16:56Argument passing in transitions
- 17:18Performance overhead evaluation
- 19:30Summary and future work
- 19:51Question and answer session
related talks
12mLibrary-based Compartmentalisation on CHERI
28mCompartmentalizing Vulnerable Kernel Components Without Stopping the Machine
22mHodor: Intra-Process Isolation for High-Throughput Data Plane Libraries
22mPrivbox: Faster System Calls Through Sandboxed Privileged Execution
50mMPK/PKS Linux Kernel Compartmentalization
16mIntroduction to Procedural Debugging through Binary Libification
19mBuilding Dynamic System Call Sandbox with Partial Order Analysis
30mRestricted Address Spaces for Container Security