Process launch constraints
A kernel of an operating system receives a request from a parent process (e.g., an exec or spawn system call) to launch a child process that executes a binary. The kernel identifies a process-specific launch constraint, which is a precondition for launching the child process. The kernel evaluates the constraint, which can match against any type of system state or variable, including the process's location on disk, protection on disk, and how the process is to be launched. The kernel can then determine whether to launch the child process, thus permitting the child process to be scheduled for execution by the operating system. Launch constraints can be used both for a child process to impose preconditions on the parent process, and vice versa. Launch constraints can be included in the launch request, embedded in the binary, or located elsewhere, such as in a trust cache in kernel memory.
1 . A non-transitory, computer-readable medium storing program instructions that, when executed by a computer system, cause the computer system to perform operations comprising:
receiving, by a kernel of an operating system executing on the computer system, a request from a parent process to launch a child process that executes a binary;
identifying, by the kernel in response to receiving the request, a set of launch constraints for the child process that are specific to the request, the set of launch constraints specifying one or more preconditions for launching the child process, wherein the set of launch constraints is distinct from a set of global launch requirements for the request, the set of global launch requirements being applicable to all system processes;
evaluating, by the kernel, the one or more preconditions; and
determining, by the kernel, whether to launch the child process based on the evaluated one or more preconditions, wherein launching the child process permits the child process to be scheduled for execution by the operating system.
2 . The computer-readable medium of claim 1 , wherein the request is an exec system call.
3 . The computer-readable medium of claim 1 , wherein the request is a spawn system call, and wherein the set of launch constraints is specified in a launch constraint argument of the request.
4 . The computer-readable medium of claim 1 , wherein the set of launch constraints is included in the binary, and wherein the binary is signed.
5 . The computer-readable medium of claim 1 , wherein the set of launch constraints is included in a trust cache located in kernel memory space.
6 . The computer-readable medium of claim 5 , wherein the binary is signed by a signature, and wherein the signature is usable by the kernel to look up the set of launch constraints in the trust cache.
7 . The computer-readable medium of claim 1 , wherein the operations further comprise:
performing, prior to receiving the request, static checking of code signatures for a file that includes the binary; and
performing, after initiating launch of the child process, dynamic checking of code signatures for pages of the binary brought into virtual memory of the computer system.
8 . The computer-readable medium of claim 1 , wherein the set of launch constraints requires launching from a particular volume.
9 . The computer-readable medium of claim 1 , wherein the set of launch constraints requires that the parent process be a particular process.
10 . The computer-readable medium of claim 1 , wherein the set of launch constraints specifies constraints on a responsible process.
11 . The computer-readable medium of claim 10 , wherein the set of launch constraints further specifies constraints on the parent process and the child process.
12 . The computer-readable medium of claim 1 , wherein the operations further comprise:
checking, by the kernel, the set of global launch requirements for the request; and
reporting, by the kernel, a failure for the request in response to one or more of the global launch requirements not being satisfied.
13 . A method, comprising:
receiving, by a kernel of an operating system executing on a computer system, a request from a parent process to launch a child process;
identifying, by the kernel in response to receiving the request, a set of launch constraints for the child process that are specific to the request, the set of launch constraints specifying one or more preconditions for launching the child process, wherein the set of launch constraints is distinct from a set of global launch requirements for the request, the set of global launch requirements being applicable to all system processes;
evaluating, by the kernel, the one or more preconditions; and
determining, by the kernel, whether to launch the child process based on the evaluated one or more preconditions, wherein launching the child process permits the child process to be scheduled for execution by the operating system.
14 . The method of claim 13 , wherein the set of launch constraints specifies a manner in which a binary for the child process is signed.
15 . The method of claim 13 , wherein the set of global launch requirements includes one or more requirements of the following set: a specified path to a binary for the child process does not exist, the parent process does not have permission to access or execute the specified path, the binary does not have executable permission, the binary is not in a format executable by the kernel, the computer system does not have current capacity to execute the child process.
16 . The method of claim 13 , wherein the set of launch constraints is formatted as a dictionary having a plurality of key-value pairs, wherein the plurality of key-value pairs includes at least one operator key specifying a logical operation to be performed on a system value.
17 . A computer system, comprising:
a memory; and
a processor circuit configured to execute program instructions stored in the memory to perform operations comprising:
receiving, by a kernel of an operating system executing on the computer system, a request from a parent process to launch a child process;
identifying, by the kernel in response to receiving the request, a set of launch constraints for the child process that are specific to the request, the set of launch constraints specifying one or more preconditions for launching the child process, wherein the set of launch constraints is distinct from a set of global launch requirements for the request, the set of global launch requirements being applicable to all system processes;
evaluating, by the kernel, the one or more preconditions; and
determining, by the kernel, whether to launch the child process based on the evaluated one or more preconditions, wherein launching the child process permits the child process to be scheduled for execution by the operating system.
18 . The computer system of claim 17 , wherein the set of launch constraints is included in a binary for the child process, and wherein the binary is signed.
19 . The computer system of claim 17 , wherein the set of launch constraints is included in a trust cache located in kernel memory space.
20 . The computer system of claim 17 , wherein the operations further comprise:
checking, by the kernel, the set of global launch requirements for the request; and
reporting, by the kernel, a failure for the request in response to one or more of the global launch requirements not being satisfied.