Defensive techniques to increase computer security
Among other disclosed subject matter, a computer-implemented method includes changing access permission level associated with a descriptor table responsive to request to update the descriptor table. In some implementation, before receiving the request to update, the descriptor table is maintained in a read-only state; and changing the access permission level comprises: allowing write access to the descriptor table responsive to determining that the update request is authorized.
1. A method comprising:
setting, by an operating system kernel, an access permission level of a descriptor table to a first permission level;
receiving, from a function by the operating system kernel, a request to update the descriptor table;
in response to receiving the request to update the descriptor table, determining, by the operating system kernel, whether the function is an operating system function or a function for another application;
determining, by the operating system kernel, that the function is an operating system function, wherein the operating system kernel is different from the operating system function;
in response to determining that the function is an operating system function, changing, by the operating system kernel, the access permission level of the descriptor table to a second permission level different than the first permission level;
updating, by the operating system kernel, the descriptor table while the access permission level of the descriptor table is the second permission level; and
after updating the descriptor table, changing, by the operating system kernel, the access permission level of the descriptor table to the first permission level.
2. The method of claim 1 , further comprising:
before receiving the request to update the descriptor table, maintaining the descriptor table in a read-only state in the first permission level.
3. The method of claim 1 , further comprising:
initializing the descriptor table using an operating system kernel.
4. The method of claim 1 , wherein setting the access permission level of the descriptor table to the first permission level comprises setting an access permission level of an interrupt descriptor table to the first permission level.
5. The method of claim 1 , wherein setting the access permission level of the descriptor table to the first permission level comprises setting an access permission level of a global descriptor table to the first permission level.
6. The method of claim 1 , wherein determining that the function is an operating system function comprises determining that the function is a hardware manager of the operating system.
7. A computing system comprising:
one or more computers; and
one or more storage units storing instructions that when executed by the one or more computers cause the one or more computers to perform operations comprising:
setting, by an operating system kernel for one of the computers, an access permission level of a descriptor table to a first permission level;
receiving, from a function by the operating system kernel, a request to update the descriptor table;
in response to receiving the request to update the descriptor table, determining, by the operating system kernel, whether the function is an operating system function or a function for another application;
determining, by the operating system kernel, that the function is an operating system function, wherein the operating system kernel is different from the operating system function;
in response to determining that the function is an operating system function, changing, by the operating system kernel, the access permission level of the descriptor table to a second permission level different than the first permission level;
updating, by the operating system kernel, the descriptor table while the access permission level of the descriptor table is the second permission level; and
after updating the descriptor table, changing, by the operating system kernel, the access permission level of the descriptor table to the first permission level.
8. The system of claim 7 , the operations further comprising:
before receiving the request to update the descriptor table, maintaining the descriptor table in a read-only state in the first permission level.
9. The system of claim 7 , the operations further comprising:
initializing the descriptor table using an operating system kernel.
10. The system of claim 7 , wherein setting the access permission level of the descriptor table to the first permission level comprises setting an access permission level of an interrupt descriptor table to the first permission level.
11. The system of claim 7 , wherein setting the access permission level of the descriptor table to the first permission level comprises setting an access permission level of a global descriptor table to the first permission level.
12. The system of claim 7 , wherein determining that the function is an operating system function comprises determining that the function is a hardware manager of the operating system.
13. A non-transitory computer storage medium encoded with a computer program, the computer program comprising instructions that when executed by a computing system cause the computing system to perform operations comprising:
setting, by an operating system kernel, an access permission level of a descriptor table to a first permission level;
receiving, from a function by the operating system kernel, a request to update the descriptor table;
in response to receiving the request to update the descriptor table, determining, by the operating system kernel, whether the function is an operating system function or a function for another application;
determining, by the operating system kernel, that the function is an operating system function, wherein the operating system kernel is different from the operating system function;
in response to determining that the function is an operating system function, changing, by the operating system kernel, the access permission level of the descriptor table to a second permission level different than the first permission level;
updating, by the operating system kernel, the descriptor table while the access permission level of the descriptor table is the second permission level; and
after updating the descriptor table, changing, by the operating system kernel, the access permission level of the descriptor table to the first permission level.
14. The non-transitory computer storage medium of claim 13 , further comprising:
before receiving the request to update the descriptor table, maintaining the descriptor table in a read-only state in the first permission level.
15. The non-transitory computer storage medium of claim 13 , further comprising:
initializing the descriptor table using an operating system kernel.
16. The non-transitory computer storage medium of claim 13 , wherein setting the access permission level of the descriptor table to the first permission level comprises setting an access permission level of an interrupt descriptor table to the first permission level.
17. The non-transitory computer storage medium of claim 13 , wherein setting the access permission level of the descriptor table to the first permission level comprises setting an access permission level of a global descriptor table to the first permission level.
18. The non-transitory computer storage medium of claim 13 , wherein determining that the function is an operating system function comprises determining that the function is a hardware manager of the operating system.