Downright: A Framework and Toolchain for Privilege Handling

No ratings

Presented at IEEESecDev 2019 by

Remo Neuhaus

We propose Downright, a novel framework basedon Seccomp, Berkeley Packet Filter, and PTrace, that makesit possible to equip new and existing C applications with arequest broker architecture. An extensive configuration languageallows AppArmor-like configuration that supports programmersin building rules for system call parameter validation and resultsanitization. Access to these privileged function calls can berestricted both within Linux kernel and user spaces.Downright’s main strength compared to related approachesis that it implements a complete mediation request brokerarchitecture, in which all system calls are vetted before execution,either by the kernel or by a request broker, which runs as anotherprocess. This isolates the main program from many failures dueto programming bugs and attacks, which would have to passnot only the attacked program, but the request broker also. Weargue that this makes acquiring and releasing elevated privilegeseasier and safer. Downright eliminates the need to write Seccompprograms, instead allowing policies to be expressed declarativelythrough a rich policy language.We demonstrate the viability of this approach by instrumenting nginx, an industrial-strength web server and reverse proxy.While this instrumentation takes only a single line of code, weargue that even this effort can be avoided by suitable C runtimecode. We show that Downright’s overhead is substantial, halvingnginx’s perfomance, but propose measures for optimisation.