Enforcing Security Policies using Transactional Memory Introspection Vinod Ganapathy Rutgers University Arnar BirgissonMohan Dhawan Ulfar ErlingssonLiviu Iftode

Take-home slide Vinod Ganapathy Transactional Memory Introspection We can utilize the mechanisms of Software Transactional Memory to greatly improve security policy enforcement

Vinod Ganapathy X server with multiple X clients REMOTE LOCAL Transactional Memory Introspection

Vinod Ganapathy REMOTE Malicious remote X client LOCAL Transactional Memory Introspection

Vinod Ganapathy REMOTE Undesirable information flow LOCAL Transactional Memory Introspection

Vinod Ganapathy Desirable information flow LOCAL REMOTE Transactional Memory Introspection

Vinod Ganapathy X server X server with authorization X client Operation requestResponse Authorization policy Reference monitor Allowed? YES/NO Transactional Memory Introspection Security enforcement crosscuts application functionality

Vinod Ganapathy Outline Enforcing authorization policies Problems with existing techniques Transactional Memory Introspection Implementation and experiments Transactional Memory Introspection

Vinod Ganapathy Existing enforcement interface dispatch_request ( ) {... perform_request ( ); } perform_request ( ) {... perform_access (resource);... perform_access’(resource’); } Transactional Memory Introspection

Vinod Ganapathy Existing enforcement interface dispatch_request ( ) {... perform_request ( ); } perform_request ( ) {... if (allowed(principal,resource,access)){ perform_access (resource); } else { handle_auth_failure1(); };... if (allowed(principal,resource’,access’)){ perform_access’(resource’); } else { handle_auth_failure2(); }; } Transactional Memory Introspection

Vinod Ganapathy Three problems Violation of complete mediation Time-of-check to Time-of-use bugs Handing authorization failures Transactional Memory Introspection

Vinod Ganapathy I. Incomplete mediation dispatch_request ( ) { … perform_request ( ); } perform_request ( ) {... if (allowed(principal,resource,access)){ perform_access (resource); } else { handle_auth_failure1(); };... if (allowed(principal,resource’,access’)){ perform_access’(resource’); } else { handle_auth_failure2(); }; } Must guard each resource access to ensure complete mediation Transactional Memory Introspection

Vinod Ganapathy I. Incomplete mediation ssize_t vfs_read (struct file *file,...) {... if (check_permission(file, MAY_READ)) { file->f_op->read(file,...); }... } int page_cache_read (struct file *file,...) { struct address_space *mapping = file->f_dentry->d_inode->i_mapping;... mapping->a_ops->readpage(file,...); } [Zhang et al., USENIX Security ‘02] Transactional Memory Introspection

Vinod Ganapathy perform_request ( ) {... if (allowed(principal,resource,access)){ perform_access (resource); } else { handle_auth_failure1() };... if (allowed(principal,resource’,access’)){ perform_access’(resource’); } else { handle_auth_failure2() }; } II. TOCTTOU bugs Transactional Memory Introspection

Vinod Ganapathy perform_request ( ) {... if (allowed(principal,resource,access)){ perform_access (resource); } else { handle_auth_failure1() };... if (allowed(principal,resource’,access’)){ perform_access’(resource’); } else { handle_auth_failure2() }; } II. TOCTTOU bugs Similar race condition found in the Linux Security Modules framework [Zhang et al. USENIX Security ’02] Several similar bugs recently found in popular enforcement tools: [Watson, WOOT ’07] GSWTK Systrace [Provos, USENIX Security ’03] OpenBSD Sysjail [Johnson and Deksters ’07] Transactional Memory Introspection

Vinod Ganapathy II. TOCTTOU bugs perform_request ( ) {... if (allowed(principal,resource,access)){ perform_access (resource); } else { handle_auth_failure1() };... if (allowed(principal,resource’,access’)){ perform_access’(resource’); } else { handle_auth_failure2() }; } Authorization check and resource access must be atomic Transactional Memory Introspection

Vinod Ganapathy III. Failure handling perform_request ( ) {... if (allowed(principal,resource,access)){ perform_access (resource); } else { handle_auth_failure1() };... if (allowed(principal,resource’,access’)){ perform_access’(resource’); } else { handle_auth_failure2() }; } Handling authorization failures is ad hoc and error prone Transactional Memory Introspection

Vinod Ganapathy III. Failure handling Exception-handling code accounts for a large fraction of server software –Over two-thirds of server software [IBM ’87] –Nearly 46% on several Java benchmarks [Weimer & Necula OOPSLA’04] Exception-handling code itself is error-prone [Fetzer and Felber ’04] SecurityException most often handled erroneously [Weimer & Necula OOPSLA’04] Transactional Memory Introspection

Vinod Ganapathy Summary of problems Violation of complete mediation –Need to identify all the resources accessed –Example: Bug in Linux Security Modules [Zhang et al., USENIX Security ‘02] Time-of-check to Time-of-use bugs –Examples: [Zhang et al., USENIX Security ‘02] [Watson, WOOT ‘07] Handing authorization failures – Large fraction of server code relates to error handling [IBM survey, ’87, Weimer and Necula, ‘04 ] –Error-handling code is error-prone! [Fetzer & Felber ’04] Security enforcement crosscuts application functionality Our solution: TMI Decouples security enforcement from application functionality Transactional Memory Introspection

Vinod Ganapathy Outline Enforcing authorization policies Problems with existing techniques Transactional Memory Introspection (TMI) –Programmer’s interface –Mechanics of TMI Implementation and experiments Transactional Memory Introspection

Vinod Ganapathy Transactional memory primer Alternative to lock-based programming Reason about atomic sections, not locks TM provides atomicity and isolation acquire(S1.lock) acquire(S2.lock) value = S1.pop() S2.push(value) Release(S2.lock) Release(S1.lock) transaction { value = S1.pop() S2.push(value) } Transactional Memory Introspection

Vinod Ganapathy Programmer’s interface to TMI dispatch_request ( ) { transaction [ principal ] {... perform_request ( ); } perform_request ( ) {... perform_access (resource);... perform_access’(resource’); } Transactional Memory Introspection

Vinod Ganapathy Programmer’s interface to TMI dispatch_request ( ) { transaction [ principal ] {... perform_request ( ); } perform_request ( ) {... perform_access (resource);... perform_access’(resource’); } Authorization manager: case (resource=R, access_type=A)  if (!allowed(principal, R, A)) then abort_tx allowed(principal, resource, access)? allowed(principal, resource’, access’)? Transactional Memory Introspection

Vinod Ganapathy I. Complete mediation for free dispatch_request ( ) { transaction [ principal ] {... perform_request ( ); } perform_request ( ) {... perform_access (resource);... perform_access’(resource’); } TMI automatically invokes authorization checks Transactional Memory Introspection

Vinod Ganapathy II. TOCTTOU-freedom for free dispatch_request ( ) { transaction [ principal ] {... perform_request ( ); } perform_request ( ) {... perform_access (resource);... perform_access’(resource’); } Conflicting resource accesses automatically abort transaction Transactional Memory Introspection

Vinod Ganapathy III. Error-handling for free dispatch_request ( ) { transaction [ principal ] {... perform_request ( ); } perform_request ( ) {... perform_access (resource);... perform_access’(resource’); } Unauthorized resource accesses automatically abort transaction Transactional Memory Introspection

Vinod Ganapathy Decouples functionality and security dispatch_request ( ) { transaction [ principal ] {... perform_request ( ); } perform_request ( ) {... perform_access (resource);... perform_access’(resource’); } Authorization manager Transactional Memory Introspection

Vinod Ganapathy Outline Enforcing authorization policies Problems with existing techniques Transactional Memory Introspection (TMI) –Programmer’s interface –Mechanics of TMI Implementation and experiments Transactional Memory Introspection

Vinod Ganapathy TM runtime system The TM runtime maintains per-transaction read/write sets and detects conflicts transaction { value = S1.pop() S2.push(value) } val1 = S1.pop() val2 = S1.pop() S2.push(val2) S2.push(val1) TransactionRead setWrite set Green S1.stkptr Red S1.stkptr, S2.stkptr Transactional Memory Introspection

Vinod Ganapathy TM runtime system Transaction body Execution Read and Write Sets Validation Contention manager Retry Commit logic Commit Transactional Memory Introspection

Vinod Ganapathy Transactional Memory Introspection Transaction body Execution Read and Write Sets Validation Contention manager Retry Commit logic CommitAuthorization Auth. checks Auth. Manager Success Failure Abort Transactional Memory Introspection

Vinod Ganapathy perform_request ( ) {... perform_access (resource);... perform_access’(resource’); } Transactional Memory Introspection dispatch_request ( ) { transaction [ principal ] {... perform_request ( ); } Present in read/write set Accesses checked before tx commits Transactional Memory Introspection

Vinod Ganapathy Outline Enforcing authorization policies Problems with existing techniques Transactional Memory Introspection Implementation and experiments Transactional Memory Introspection

Vinod Ganapathy TMI Implementation: TMI/DSTM2 Implemented using Sun’s DSTM2 Object-based software TM system TM system modified to –Trigger authorization checks on additions to read/write set and upon transaction validation –Raise AccessDeniedException upon abort –Integrate transactional I/O libraries Fewer than 500 lines changed in DSTM2 Transactional Memory Introspection

Vinod Ganapathy Porting software to TMI/DSTM2 1.Mark transactional objects –Also wrappers for libraries: java.util.HashMap, java.util.Vector 2.Reads and writes to fields objects replaced with DSTM2 accessors 3.Place transaction{…} blocks around client requests 4.Write an authorization manager Transactional Memory Introspection

Vinod Ganapathy GradeSheet in TMI/DSTM2 Transactional Memory Introspection

Vinod Ganapathy Evaluation Ported four Java-based servers GradeSheet: A grade-management server FreeCS: A chat server WeirdX: An X window management server –Enforced a simple XACML based policy Tar: A tar archive service –Enforced Java stack inspection policy Transactional Memory Introspection

Vinod Ganapathy Modifications needed ServerLOCLines modifiedTransactions GradeSheet Tar service5,000< 501 FreeCS22, WeirdX27,0004, Authorization managers were approximately 200 lines of code in each case Transactional Memory Introspection

Vinod Ganapathy perform_request ( ) {... perform_access (resource);... perform_access’(resource’); } When to enforce policy? dispatch_request ( ) { transaction [ principal ] {... perform_request ( ); } allowed(principal, resource, access)? allowed(principal, resource’, access’)? Eager Transactional Memory Introspection

Vinod Ganapathy perform_request ( ) {... perform_access (resource);... perform_access’(resource’); } When to enforce policy? dispatch_request ( ) { transaction [ principal ] {... perform_request ( ); } allowed(principal, resource, access)? allowed(principal, resource’, access’)? Lazy Transactional Memory Introspection

Vinod Ganapathy perform_request ( ) {... perform_access (resource);... perform_access’(resource’); } When to enforce policy? dispatch_request ( ) { transaction [ principal ] {... perform_request ( ); } allowed(principal, resource, access)? allowed(principal, resource’, access’)? Parallel Transactional Memory Introspection

Vinod Ganapathy Performance overheads of TMI 10x -15.8% Transactional Memory Introspection

Vinod Ganapathy Performance overheads of STM Software transactional memory imposes a significant overhead ServerNativeTMI-portedOverhead GradeSheet395μs451μs14.7% Tar service4.96s15.40s2.1x FreeCS321μs3907μs11.2x WeirdX0.23ms6.40ms26.8x Hardware TMs reduce runtime overheads of TM runtime systems Transactional Memory Introspection

Take-home message Vinod Ganapathy Transactional Memory Introspection We can utilize the mechanisms of Software Transactional Memory to greatly improve security policy enforcement

Vinod Ganapathy Rutgers University Thank you! Reference: Enforcing Authorization Policies using Transactional Memory Introspection Proc. ACM CCS, October 2008