System and method for enforcing security policies in a virtual environment
View Patent ↗A method in one example implementation includes intercepting a request associated with an execution of an object (e.g., a kernel module or a binary) in a computer configured to operate in a virtual machine environment. The request is associated with a privileged domain of the computer that operates logically below one or more operating systems. The method also includes verifying an authorization of the object by computing a checksum for the object and comparing the checksum to a plurality of stored checksums in a memory element. The execution of the object is denied if it is not authorized. In other embodiments, the method can include evaluating a plurality of entries within the memory element of the computer, wherein the entries include authorized binaries and kernel modules. In other embodiments, the method can include intercepting an attempt from a remote computer to execute code from a previously authorized binary.
1. A method, comprising:
inserting a security layer in a privileged domain of a computer configured to perform virtualization, wherein:
the security layer is in a kernel of a privileged domain of a computer configured to operate in a virtual machine environment; and
the privileged domain of the computer manages a virtual machine monitor (VMM) that operates at a higher priority than one or more operating systems;
storing an indication of authorized objects, the authorized objects in a user space of the privileged domain;
intercepting, by the security layer, a request for an execution of an object in the computer from the user space of the privileged domain;
verifying the request for execution of the object by evaluating the indication of authorized objects; and
allowing or denying the execution of the object based upon the verification of the request.
2. The method of claim 1 , wherein evaluating the indication of authorized objects includes evaluating authorized binaries and kernel modules.
3. The method of claim 1 , further comprising:
intercepting an attempt to execute code from a previously authorized binary; and
evaluating an origination address of a hypercall associated with the code before executing the code.
4. The method of claim 1 , wherein evaluating the indication of authorized objects includes comparing the object to an inventory of authorized objects stored in a user space of the computer.
5. The method of claim 4 , further comprising populating a log based on a determination that the execution of the object is not authorized.
6. The method of claim 1 , wherein:
the attempted execution of the object is an attempted execution of a kernel module to perform a hypercall to access a privileged domain area within the computer; and
evaluating the indication of authorized objects includes evaluating whether the hypercall to access a privileged domain area within the computer is authorized.
7. The method of claim 1 , wherein:
the attempted execution of the object is an attempted modification of a virtual machine state; and
evaluating the indication of authorized objects includes evaluating whether the attempted modification of the virtual machine state is authorized.
8. A logic encoded in one or more tangible non-transitory media that includes code for execution and when executed by a processor is operable to:
insert a security layer in a privileged domain of a computer, wherein:
the security layer is in a kernel of a privileged domain of a computer configured to operate in a virtual machine environment; and
the privileged domain is configured to manage a virtual machine monitor (VMM) that operates at a higher priority than one or more operating systems;
store an indication of authorized objects in a user space of the privileged domain;
intercept, by the security layer, a request for an execution of an object in the computer from the user space of the privileged domain;
verify the request for execution of the object by evaluating the indication of authorized objects; and
allow or deny the execution of the object based upon the verification of the request.
9. The logic encoded in tangible non-transitory media of claim 8 , wherein the processor is further operable to evaluate the indication of authorized objects by evaluating whether the object is included in authorized binaries and kernel modules.
10. The logic encoded in tangible non-transitory media of claim 8 , wherein the processor is further operable to:
intercept, by the security layer, an attempt to execute code from a previously authorized binary; and
evaluate an origination address of a hypercall associated with the code before executing the code.
11. The logic encoded in tangible non-transitory media of claim 8 , wherein the processor is further operable to evaluate the indication of authorized objects by comparing the object to an inventory of authorized objects stored in a user space of the computer.
12. The logic encoded in tangible non-transitory media of claim 11 , wherein the processor is further operable to populate a log based on a determination that the execution of the object is not authorized.
13. The logic encoded in tangible non-transitory media of claim 8 , wherein:
the attempted execution of the object is an attempted execution of a kernel module to perform a hypercall to access a privileged domain area within the computer; and
the processor is further operable to evaluate the indication of authorized objects by evaluating whether the hypercall to access a privileged domain area within the computer is authorized.
14. The logic encoded in tangible non-transitory media of claim 8 , wherein:
the attempted execution of the object is an attempted modification of a virtual machine state; and
the processor is further configured to evaluate the indication of authorized objects by evaluating whether the attempted modification of the virtual machine state is authorized.
15. An apparatus, comprising:
a virtual machine element comprising instructions in a memory; and
a processor operable to execute the instructions in the memory to operate the virtual machine element;
wherein the virtual machine element is configured to:
insert a security layer in a privileged domain of the apparatus, wherein:
the security layer is in a kernel of a privileged domain of a computer configured to operate in a virtual machine environment; and
the privileged domain of the apparatus manages a virtual machine monitor (VMM) that operates at a higher priority than one or more operating systems; and
store an indication of authorized objects in a user space of the privileged domain;
wherein the security layer is configured to intercept a request for an execution of an object in the computer from the user space of the privileged domain; and
wherein the virtual machine element is further configured to:
verify the request for execution of the object by evaluating the indication of authorized objects;
allow or deny the execution of the object based upon the verification of the request.
16. The apparatus of claim 15 , wherein:
the security layer is further configured to intercept an attempt to execute code from a previously authorized binary; and
the virtual machine element is further configured to evaluate an origination address of a hypercall associated with the code before executing the code.
17. The apparatus of claim 15 , wherein the virtual machine element is further configured to evaluate the indication of authorized objects by comparing the object to an inventory of authorized objects stored in a user space of the computer.
18. The apparatus of claim 17 , wherein the virtual machine element is further configured to populate a log based on a determination that the execution of the object is not authorized.
19. The apparatus of claim 15 , wherein:
the attempted execution of the object is an attempted execution of a kernel module to perform a hypercall to access a privileged domain area within the computer; and
wherein the virtual machine element is further configured to evaluate the indication of authorized objects by evaluating whether the hypercall to access a privileged domain area within the computer is authorized.
20. The apparatus of claim 15 , wherein:
the attempted execution of the object is an attempted modification of a virtual machine state; and
wherein the virtual machine element is further configured to evaluate the indication of authorized objects by evaluating whether the attempted modification of the virtual machine state is authorized.