OS Agnostic Sandboxing Using Virtual CPUs
Loading...
Files
Date
2011-07-21
Authors
Journal Title
Journal ISSN
Volume Title
Publisher
Abstract
Commodity operating systems have a poor track record when it comes to security. Malware and
viruses aim at exploiting vulnerabilities and e.g. try to steal the users private data. Unfortunately
most of todays operating systems do not allow to enforce the principle of least authority as their
security mechanisms are to coarse grained.
In this work we show how we built an OS agnostic sandbox using virtual CPUs. It allows the
execution of native code and thus does not wear the burden of an inherent performance penalty.
To show the efficiency and usability of our solution we have built a secure execution container for
web browser plugins.
Background Sandboxing techniques were developed to jail a program into a restricted execution
environment [WLAG93]. Per default critical operations (e.g. syscalls) are disallowed and as such
trap into the sandbox host. There for example arguments of the critical operation can be inspected
and sanitized. Although e.g. the Java VM provides a restricted execution environment it is often
disliked due to its performance penalty. Other sandboxing techniques like Googles Native Client
(NaCl) rely on specific characteristics of the underlying platform.
Design The virtual CPU model (vCPU) is an execution abstraction that strongly resembles to
physical CPUs [LWP2010]. It features upcalls, virtual interrupts, a state indicator and a state save
area. The vCPU model allows for sequential execution while supporting control
ow diversions
upon events. We chose to base our architecture on the vCPU model as it allows the traditional
thread model to be easily combined with an asynchronous event model.
Our architecture is designed to maximize data throughput with a zero-copy shared-memory
interface between a sandboxed client and the host. The computational overhead is minimized by
allowing native execution. To minimize event latency we designed an efficient event notification
mechanism using event buffers.
First Results Our vCPU model is implemented using ptrace which allows the client to run natively.
The measurements show that sandboxed clients perform comparable to native performance.
The event latency is constant and does not depend on the number of concurrently running vCPU
threads. Preliminary measurements indicate that the data throughput is sufficient for multimedia
applications.