Secure module build center
An apparatus including a secure module build center, configured generate modules corresponding to consumer computing systems that each run one of a plurality of operating system types and versions. The center has a coordination server that receives configuration and makefile data associated with one of the consumer computing systems, places the data in a queue, and provides a built module to the one of the consumer computing systems; and a build server that receives the data from the queue, and generates the built module based on commands within the makefile data.
1. A secure module building apparatus, comprising:
a computer program product encoded in at least one non-transitory computer usable medium that, when executed, functions as:
a secure module build center, configured generate modules corresponding to consumer computing systems, each of said consumer computing systems running one of a plurality of operating system types and versions, said secure module build center comprising:
a coordination server, configured to receive configuration and makefile data associated with one of said consumer computing systems, and configured to place said data in a queue, and configured to provide a built module to said one of said consumer computing systems; and
a build server, coupled to said coordination server and corresponding to said configuration data, configured to receive said data from said queue, and configured to generate the built module based on commands within said makefile data, said build server comprising:
a module build compiler, disposed within a secure root, configured to access a log file, and configured to execute whitelist commands stored therein to generate named object files from proprietary source files for transfer to a public root; and
a wrapper module build compiler, disposed within said public root, configured to extract said whitelist commands from said makefile data to generate said log file, and to rename said named object files into renamed object files according to said whitelist commands, wherein said renamed object files are provided to a wrapper linker disposed within said public root, and wherein said wrapper linker links said renamed objects files according to said whitelist commands to generate said built module.
2. The secure module building apparatus as recited in claim 1 , wherein said plurality of operating system types and versions comprises Unix-based operating systems, and wherein said one of said computer computing system loads said built module within a kernel at run time.
3. The secure module building apparatus as recited in claim 1 , wherein execution of said whitelist commands within said secure root precludes execution of malicious commands that are within said makefile data, thereby improving security of said build server.
4. The secure module building apparatus as recited in claim 1 , wherein said proprietary source files are stored exclusively in said secure root.
5. The secure module building apparatus as recited in claim 1 , wherein execution of said whitelist commands within said secure root transforms said proprietary source code files into named object files, and wherein said named object files are in binary form, and wherein said binary form does not reveal instructions in said proprietary source files.
6. The secure module building apparatus as recited in claim 1 , wherein said module build compiler is compatible with said one of said consumer computing systems.
7. The secure module building apparatus as recited in claim 6 , wherein said wrapper module build compiler appears to perform operations according to said module build compiler, but rather extracts said whitelist commands from said makefile data.
8. The secure module building apparatus as recited in claim 7 , wherein said wrapper module build compiler generates an alternative module when said whitelist commands are insufficient to build said built module.
9. A secure module building apparatus, comprising:
a computer program product encoded in at least one non-transitory computer usable medium that, when executed, functions as:
a secure module build center, configured generate modules corresponding to consumer computing systems, each of said consumer computing systems running one of a plurality of operating system types and versions, said secure module build center comprising:
a coordination server, configured to receive configuration and makefile data associated with one of said consumer computing systems, and configured to place said data in a queue, and configured to provide a built module to said one of said consumer computing systems; and
a build server, coupled to said coordination server and corresponding to said configuration data, configured to receive said data from said queue, and configured to generate the built module based on commands within said makefile data, said build server comprising:
a module build compiler, disposed within a secure root, configured to access a log file, and configured to execute whitelist commands stored therein to generate named object files from proprietary source files for transfer to a public root;
a wrapper module build compiler, disposed within said public root, configured to extract said whitelist commands from said makefile data to generate said log file, and to rename said named object files into renamed object files according to said whitelist commands; and
a wrapper linker, disposed within said public root, configured to link said renamed object files according to said whitelist commands to generate said built module.
10. The secure module building apparatus as recited in claim 9 , wherein said plurality of operating system types and versions comprises Unix-based operating systems, and wherein said one of said computer computing system loads said built module within a kernel at run time.
11. The secure module building apparatus as recited in claim 9 , wherein execution of said whitelist commands within said secure root precludes execution of malicious commands that are within said makefile data, thereby improving security of said build server.
12. The secure module building apparatus as recited in claim 9 , wherein said proprietary source files are stored exclusively in said secure root.
13. The secure module building apparatus as recited in claim 9 , wherein execution of said whitelist commands within said secure root transforms said proprietary source code files into named object files, and wherein said named object files are in binary form, and wherein said binary form does not reveal instructions in said proprietary source files.
14. The secure module building apparatus as recited in claim 9 , wherein said module build compiler is compatible with said one of said consumer computing systems.
15. The secure module building apparatus as recited in claim 14 , wherein said wrapper module build compiler appears to perform operations according to said module build compiler, but rather extracts said whitelist commands from said makefile data.
16. The secure module building apparatus as recited in claim 15 , wherein said wrapper module build compiler generates an alternative module when said whitelist commands are insufficient to build said built module.
17. A secure module building method, comprising:
via a secure module build center, building modules corresponding to consumer computing systems, each of the consumer computing systems running one of a plurality of operating system types and versions, said building comprising:
via a coordination server, receiving configuration and makefile data associated with one of the consumer computing systems, and placing the data in a queue, and providing a built module to the one of the consumer computing systems; and
via a build server, receiving the data from the queue, and generating a built module based on commands within the makefile data, said generating comprising:
via a module build compiler disposed within a secure root, accessing a log file, and executing whitelist commands stored therein to generate named object files from proprietary source files for transfer to a public root; and
via a wrapper module build compiler disposed within a public root, extracting said whitelist commands from the makefile data to generate the log file, and renaming the named object files into renamed object files according to the whitelist commands, wherein the renamed object files are provided to a wrapper linker disposed within the public root, and wherein the wrapper linker links the renamed objects files according to the whitelist commands to generate the built module.
18. The method as recited in claim 17 , wherein the plurality of operating system types and versions comprises Unix-based operating systems, and wherein the one of the computer computing system loads the built module within a kernel at run time.
19. The method as recited in claim 17 , wherein said executing of the whitelist commands within the secure root precludes execution of malicious commands that are within the makefile data, thereby improving security of the build server.
20. The method as recited in claim 17 , wherein the proprietary source files are stored exclusively in the secure root.
21. The method as recited in claim 17 , wherein said executing of the whitelist commands in the secure root comprises transforming the proprietary source code files into named object files, and wherein the named object files are in binary form, and wherein the binary form does not reveal instructions in the proprietary source files.
22. The method as recited in claim 17 , wherein the module build compiler is compatible with the one of the consumer computing systems.
23. The method as recited in claim 22 , wherein the wrapper module build compiler appears to perform operations according to the module build compiler, but rather extracts the whitelist commands from the makefile data.
24. The method as recited in claim 23 , wherein the wrapper module build compiler generates an alternative module when the whitelist commands are insufficient to build the built module.