Software fault isolation using byte-granularity memory protection
Software fault isolation methods using byte-granularity memory protection are described. In an embodiment, untrusted drivers or other extensions to a software system are run in a separate domain from the host portion of the software system, but share the same address space as the host portion. Calls between domains are mediated using an interposition library and access control data is maintained for substantially each byte of relevant virtual address space. Instrumentation added to the untrusted extension at compile-time, before load-time, or at runtime and added by the interposition library enforces the isolation between domains, for example by adding access right checks before any writes or indirect calls and by redirecting function calls to call wrappers in the interposition library. The instrumentation also updates the access control data to grant and revoke access rights on a fine granularity according to the semantics of the operation being invoked.
1. A computer-implemented method of running an extensible software system comprising, on a computing system:
running a host portion of the software system in a first domain;
running at least one extension to the software system in a second domain, the extension comprising an untrusted extension instrumented to include at least one access right check;
storing access control data for substantially each byte of relevant virtual address space comprising:
storing a first data structure comprising access right data associated with substantially each memory slot, a memory slot comprising a fixed number of bytes of relevant virtual address space;
storing a second data structure comprising access right data associated with each byte of virtual address space in at least one memory slot;
mediating calls between the first domain and the second domain using an interposition library comprising a plurality of wrappers for functions; and
checking access rights before a write operation using the access control data comprising:
using the first data structure to obtain access right data for a memory slot comprising a byte of virtual address space to be written; and
if the access right data obtained using the first data structure indicates a conflict, using the second data structure to obtain access right data for the byte of virtual address space to be written.
2. A method according to claim 1 , further comprising:
updating the access control data based on instrumentation added to the untrusted extension and wrappers in the interposition library.
3. A method according to claim 1 , wherein mediating calls between the first domain and the second domain using the interposition library comprises:
using the access control data to check access rights for items presented to the first domain by the second domain on control transfers from the second domain to the first domain; and
updating access rights in the access control data for items presented to a domain on control transfers between the domains.
4. A method according to claim 1 , wherein the access rights comprise write and indirect call rights and the method further comprising: checking access rights before an indirect call.
5. A method according to claim 1 , wherein the access rights comprise write and type rights and the method further comprising: checking a type right of an object passed in a call between domains.
6. A method according to claim 1 , wherein the access rights comprise write and ownership rights and the method further comprising: checking an ownership right of an allocated object.
7. A method according to claim 1 , wherein the access control data comprises an access control list for substantially each byte of relevant virtual address space.
8. A method according to claim 1 , wherein access right data comprises an integer arranged to encode a pair comprising a domain and an access right.
9. A method according to claim 1 , wherein the extension is further instrumented to align local and global variables in memory slots.
10. A method according to claim 1 , wherein the extension is further instrumented to include code to grant and revoke access rights.
11. A method according to claim 1 , wherein the extension is further instrumented to rewrite calls to functions in the host portion of the software system to call wrappers stored in the interposition library.
12. A method according to claim 1 , wherein the extension is further instrumented to modify code in the extension that takes an address of a host portion function to take an address of a corresponding wrapper in the interposition library.
13. A method according to claim 1 , wherein the host portion comprises a kernel and the extension comprises an untrusted driver.
14. A method according to claim 1 , further comprising, on the computing system, running a trusted extension to the software system in the first domain.
15. A computer-implemented method of compiling an extension to a software system comprising, on a computing system:
receiving, at an input, the extension to the software system;
inserting code into the extension to set and check access rights, the access rights being stored in an access control list for substantially each byte of virtual address space;
the code to set access rights comprising code to update a first data structure comprising access right data associated with substantially each memory slot, a memory slot comprising a fixed number of bytes of virtual address space and a second data structure comprising access right data associated with each byte of virtual address space in at least one memory slot;
the code to check access rights comprising code to access the first data structure to obtain access right data for a memory slot comprising a byte of virtual address space to be written; and code to access the second data structure to obtain access right data for the byte of virtual address space to be written if the access right data obtained using the first data structure indicates a conflict; and
rewriting calls to functions in a host portion of the software system to call wrappers stored in an interposition library.
16. A method according to claim 15 , further comprising:
aligning data in slots comprising a fixed number of bytes.
17. A method according to claim 15 , further comprising:
creating and storing a list of address-taken functions.
18. A method according to claim 15 , further comprising:
modifying code in the extension that takes an address of a host portion function to take an address of a corresponding wrapper in the interposition library.
19. A computing device comprising:
a processor; and
memory arranged to store an operating system and at least one untrusted driver, wherein the at least one untrusted driver is instrumented to include at least access right check and wherein the memory is further arranged to store executable instructions to cause the processor to:
run a kernel of the operating system and the untrusted driver in separate domains;
maintain an access control list for substantially each byte of relevant virtual address space comprising:
storing a first data structure comprising access right data associated with substantially each memory slot, a memory slot comprising a fixed number of bytes of relevant virtual address space; and
storing a second data structure comprising access right data associated with each byte of virtual address space in at least one memory slot;
mediate calls between domains using an interposition library, the library comprising a plurality of wrappers for kernel and driver functions; and
check access rights before each write operation and before each indirect call using the access control list comprising:
using the first data structure to obtain access right data for a memory slot comprising a byte of virtual address space to be written; and
if the access right data obtained using the first data structure indicates a conflict, using the second data structure to obtain access right data for the byte of virtual address space to be written.