Path-based access control for message-based operating systems
A system and method enforce file system path-based access controls in a message-based operating system. The system and method enforce a list of rules that provide a grant and an access restriction to file system paths to server applications. A path manager receives client messages marked by a kernel to indicate that the client is subject to the path-based access controls. The path manager control access to the file systems served by the server applications in response to the rules that provide grants and access restrictions. The path manager exercises that control by transmitting messages to the client that establishes privileges to systems paths through an authentication protocol.
1. A system to enforce file system path-based access control in a message-based operating system, the system comprising:
a processor; and
a memory storing a path manager, the path manager comprising instructions executable by the processor to configure the processor to:
receive a client message via a communication channel, corresponding to a request from a client to open a file system path, the client message having been flagged by a kernel to indicate that the client is associated with a restricted operating system environment;
evaluate the file system path against path-based access controls to determine that the client is permitted to open the file system path; and
further to a determination that the client is permitted to open the file system path, transmit a reply message to the client granting access to the file system path, the reply message including a digital signature by the path manager of a hash of the reply message, the digital signature being encrypted using a client public key, wherein the client may access the file system path by providing the encrypted digital signature to a server servicing the file system path, and wherein the server requests validation of the digital signature by the kernel, wherein the validation is by using a client private key held by the kernel and unavailable to the client.
2. The system of claim 1 , wherein the digital signature is generated using at least one of public-key cryptography or a one-way hash function.
3. The system of claim 1 , wherein the message-based operating system comprises a distributed operating system in which file system control is not part of the kernel.
4. The system of claim 1 , wherein the path-based access controls correspond to a sandbox.
5. The system of claim 1 , wherein the kernel comprises a micro-kernel.
6. The system of claim 1 wherein evaluating the file system path against path-based access controls to determine that the client is permitted to open the file system path includes determining that the file system path is part of a shadow tree associated with the client.
7. The system of claim 1 , wherein evaluating the file system path against path-based access controls includes matching the file system path against a list of rules.
8. The system of claim 7 , wherein a configuration file generates the list of rules.
9. The system of claim 7 , wherein evaluating the file system path against path-based access controls includes matching a canonical, absolute version of the file system path against the list of rules.
10. The system of claim 7 , wherein the list of rules includes at least one of a forbidden rule or an allowed rule, wherein the client is forbidden to access file system paths matching the forbidden rule and wherein the client is permitted to access file system paths matching the allowed rule.
11. The system of claim 1 , wherein the instructions are executable by the processor to further configure the processor to:
receive a second client message corresponding to a request by the client to open a second file system path, the second client message having been flagged by the kernel to indicate that the client is associated with the restricted operating system environment;
evaluate the second file system path against the path-based access controls to determine that the client is not permitted to open the second file system path; and
further to a determination that the client is not permitted to open the second file system path, reject access to the second file system path.
12. The system of claim 11 wherein rejecting access to the second file system path does not include transmitting a reply message to the client via the communication channel.
13. A non-transitory computer readable medium storing a path manager, the path manager comprising instructions executable by a processor, the instructions executable to:
receive a client message through a communication channel in a message-based operating system, the client message corresponding to a request from a client to open a file system path, the client message having been flagged by a kernel to indicate that the client is associated with a restricted operating system environment;
evaluate the file system path against path-based access controls to determine that the client is permitted to open the file system path; and
further to a determination that the client is permitted to open the file system path, transmit a reply message to the client granting access to the file system path, the reply message including a digital signature by the path manager of a hash of the reply message, the digital signature being encrypted using a client public key, wherein the client may access the file system path by providing the encrypted digital signature to a server servicing the file system path, and wherein the server requests validation of the digital signature by the kernel, wherein the validation is by using a client private key held by the kernel and unavailable to the client.
14. The non-transitory computer readable medium of claim 13 , wherein the digital signature is generated using at least one of public-key cryptography or a one-way hash function.
15. The non-transitory computer readable medium of claim 13 , wherein the kernel comprises a micro-kernel.
16. The non-transitory computer readable medium of claim 13 , wherein evaluating the file system path against path-based access controls includes matching the file system path against a list of rules.
17. The non-transitory computer readable medium of claim 16 , wherein the list of rules is provisioned through a configuration file.
18. The non-transitory computer readable medium of claim 16 wherein the list of rules includes a first rule that grants access to at least a first file system path and the list of rules includes a second rule that denies access to at least a second file system path.
19. The non-transitory computer readable medium of claim 16 , wherein evaluating the file system path against path-based access controls includes matching a canonical, absolute version of the file system path against the list of rules.
20. The non-transitory computer readable medium of claim 13 , wherein the message-based operating system comprises a distributed operating system in which file system control is not part of the kernel.
21. The non-transitory computer readable medium of claim 13 , wherein the path-based access controls correspond to a sandbox.
22. A method to enforce file system path-based access controls in a message-based operating system, the method comprising:
receiving, by a path manager, a client message through a communication channel, the client message corresponding to a request from a client to open a file system path, the client message having been flagged by a kernel of the message-based operating system to indicate that the client is associated with a restricted operating system environment;
evaluating, by the path manager, the file system path against path-based access controls to determine that the client is permitted to open the file system path; and
further to determining that the client is permitted to open the file system path, transmitting, by the path manager, a reply message to the client granting access to the file system path, the reply message including a digital signature by the path manager of a hash of the reply message, the digital signature being encrypted using a client public key, wherein the client may access the file system path by providing the encrypted digital signature to a server servicing the file system path, and wherein the server requests validation of the digital signature by the kernel, wherein the validation is by using a client private key held by the kernel and unavailable to the client.
23. The method of claim 22 wherein the kernel comprises a micro-kernel and file system control is not part of the kernel.
24. The method of claim 22 wherein evaluating the file system path against path-based access controls to determine that the client is permitted to open the file system path includes determining that the file system path is part of a shadow tree associated with the client.