Secure Programs via Game-based Synthesis Somesh Jha, Tom Reps, and - PowerPoint PPT Presentation

Capsicum Challenges Not Appearing in This Talk • Program can construct capability from each UNIX descriptor • Capability has a vector of 63 access rights (~1 for every system call on a descriptor) • Programs can assume new capabilities via a Remote Procedure Call (RPC) 19 Tuesday, October 22, 13

Instrumenting Programs with CapWeave 1. Programmer writes an explicit Amb policy 2. CapWeave instruments program to invoke primitives so that it satisfies the policy 20 Tuesday, October 22, 13

with CapWeave gzip main() { file_nms = parse_cl(); for (f in file_nms): L0: (in, out) = open2(f); L1: compress(in, out); } L0: AMB L1: no AMB 21 Tuesday, October 22, 13

with CapWeave gzip main() { file_nms = parse_cl(); for (f in file_nms): L0: (in, out) = open2(f); L1: compress(in, out); } Policy Cur(p) => (pc[L0](p) => AMB(p) & (pc[L1](p) => !AMB(p)) 21 Tuesday, October 22, 13

main() { file_nms = parse_cl(); for (f in file_nms): L0: (in, out) = open2(f); L1: compress(in, out); } Policy Cur(p) => (pc[L0](p) => AMB(p) & (pc[L1](p) => !AMB(p)) 22 Tuesday, October 22, 13

Policy main() { Cur(p) => (pc[L0](p) => AMB(p) file_nms = parse_cl(); & (pc[L1](p) => !AMB(p)) for (f in file_nms): L0: (in, out) = open2(f); L1: compress(in, out); } 22 Tuesday, October 22, 13

Policy main() { Cur(p) => (pc[L0](p) => AMB(p) file_nms = parse_cl(); & (pc[L1](p) => !AMB(p)) for (f in file_nms): L0: (in, out) = open2(f); L1: compress(in, out); } CapWeave 22 Tuesday, October 22, 13

Policy main() { Cur(p) => (pc[L0](p) => AMB(p) file_nms = parse_cl(); & (pc[L1](p) => !AMB(p)) for (f in file_nms): L0: (in, out) = open2(f); L1: compress(in, out); } CapWeave void main() { L0: open2(...); Instrumented sync_fork(); cap_enter(); Program L1: compress(); sync_join(); } 22 Tuesday, October 22, 13

The Next 700 Policy Weavers Analogous challenges with Decentralized Information Flow Control (DIFC) • Asbestos [Efstathopoulos ‘05] • HiStar [Zeldovich ’06] • Flume [Krohn ‘07] 23 Tuesday, October 22, 13

gzip() { Policy file_nms = parse_cl(); Cur(p) => ... (pc[L0](p) => AMB(p)) & (pc[L1](p) => !AMB(p)) } CapWeave gzip() { file_nms = parse_cl(); sync_fork(); cap_enter(); ... } 24 Tuesday, October 22, 13

Programmer gzip() { Policy file_nms = parse_cl(); Cur(p) => ... (pc[L0](p) => AMB(p)) & (pc[L1](p) => !AMB(p)) } Weaver CapWeave Generator gzip() { file_nms = parse_cl(); sync_fork(); cap_enter(); ... } 24 Tuesday, October 22, 13

Programmer Capsicum Designer gzip() { Policy cap_enter: Amb’(p) := Amb(p) & ... file_nms = parse_cl(); Cur(p) => ... (pc[L0](p) => AMB(p)) & (pc[L1](p) => !AMB(p)) } Weaver CapWeave Generator gzip() { file_nms = parse_cl(); sync_fork(); cap_enter(); ... } 24 Tuesday, October 22, 13

Weaver Generator 25 Tuesday, October 22, 13

HiStar Designer create_cat(&c): Flows’(p, q) := Flows(p, q) || ... Weaver Generator 25 Tuesday, October 22, 13

HiStar Designer create_cat(&c): Flows’(p, q) := Flows(p, q) || ... Weaver HiWeave Generator 25 Tuesday, October 22, 13

Programmer HiStar Designer wrapper() { create_cat(&c): Policy exec(...); Flows’(p, q) := Flows(p, q) || ... forall w, s. ... Flows(w, s) => ... } Weaver HiWeave Generator 25 Tuesday, October 22, 13

Programmer HiStar Designer wrapper() { create_cat(&c): Policy exec(...); Flows’(p, q) := Flows(p, q) || ... forall w, s. ... Flows(w, s) => ... } Weaver HiWeave Generator scanner() { create_cat(&c); exec(...); ... } 25 Tuesday, October 22, 13

Outline 1. Motivation, problem statement 2. Previous work: Capsicum 2. Previous work: Capsicum 3. Ongoing work: HiStar 4. Open challenges 26 Tuesday, October 22, 13

Outline 2. Previous work: Capsicum 26 Tuesday, October 22, 13

CapWeave Algorithm 27 Tuesday, October 22, 13

CapWeave Algorithm Inputs: Program P , Amb Policy Q 27 Tuesday, October 22, 13

CapWeave Algorithm Inputs: Program P , Amb Policy Q Output: Instrumentation of P that always satisfies Q 27 Tuesday, October 22, 13

CapWeave Algorithm Inputs: Program P , Amb Policy Q Output: Instrumentation of P that always satisfies Q 1. Build finite IP# ⊇ instrumented runs that violate Q 27 Tuesday, October 22, 13

1. Building IP#: Inputs Program Amb Policy L0 : Amb main() { L1 : no Amb file_nms = parse_cl(); for (f in file_nms): L0: (in, out) = open2(f); L1: compress(in, out); } 28 Tuesday, October 22, 13

1. Building IP#: Output parse_cl cap_enter noop L0:open2() L0:open2() sync_join() noop sync_fork() noop noop noop noop cap_enter() cap_enter() L1:compress() L1:compress() L1:compress() L1:compress() noop L0:open2() 29 Tuesday, October 22, 13

1. Building IP#: Output parse_cl cap_enter noop L0:open2() L0:open2() sync_join() noop sync_fork() noop noop noop noop cap_enter() cap_enter() L1:compress() L1:compress() L1:compress() L1:compress() noop L1 : no Amb L0:open2() 29 Tuesday, October 22, 13

1. Building IP#: Output parse_cl cap_enter noop L0:open2() L0:open2() sync_join() noop sync_fork() noop noop noop noop cap_enter() cap_enter() L1:compress() L1:compress() L1:compress() L1:compress() noop L0:open2() 30 Tuesday, October 22, 13

1. Building IP#: Output parse_cl cap_enter noop L0:open2() L0:open2() sync_join() noop sync_fork() noop noop noop noop cap_enter() cap_enter() L1:compress() L1:compress() L1:compress() L1:compress() noop L0:open2() L0 : Amb 30 Tuesday, October 22, 13

Building IP# Basic idea: construct IP# as a forward exploration of an abstract state space 31 Tuesday, October 22, 13

1(a). IP#: Define Abstract State-space Q 32 Tuesday, October 22, 13

1(a). IP#: Define Abstract State-space Q# Q 32 Tuesday, October 22, 13

1(a). IP#: Define Abstract State-space Q# 𝛽 Q 32 Tuesday, October 22, 13

1(a). IP#: Define Abstract State-space Q# 𝛽 Q 32 Tuesday, October 22, 13

1(b). IP#: Define Abstract Transformers Q# 𝛽 Q 33 Tuesday, October 22, 13

1(b). IP#: Define Abstract Transformers Q# 𝛽 Q 𝜐 [cap_enter] 33 Tuesday, October 22, 13

1(b). IP#: Define Abstract Transformers 𝜐 [cap_enter]# Q# 𝛽 Q 𝜐 [cap_enter] 33 Tuesday, October 22, 13

1(c). Explore Abstract State Space Q# Q 34 Tuesday, October 22, 13

1(c). Explore Abstract State Space Q# 𝛽 Q L0 init 34 Tuesday, October 22, 13

1(c). Explore Abstract State Space 𝜐 [cap_enter]# ... 𝜐 [parse_cl]# Q# .. 𝛽 𝜐 [noop]# cap_enter ... parse_cl Q L0’ L0 init noop ... 34 Tuesday, October 22, 13

𝜐 [parse_cl]# 35 Tuesday, October 22, 13

𝜐 [parse_cl]# 35 Tuesday, October 22, 13

parse_cl cap_enter noop L0:open2() L0:open2() sync_join() noop sync_fork() noop noop noop noop cap_enter() cap_enter() L1:compress() L1:compress() L1:compress() L1:compress() noop L0:open2() 35 Tuesday, October 22, 13

State-Structure Exploration If a concrete state is a logical structure, ... Q 36 Tuesday, October 22, 13

State-Structure Exploration If a concrete state is a logical structure, ... ≡ { } A A D Q B B C 36 Tuesday, October 22, 13

State-Structure Exploration properties are FOL formulas, ... ∀ p. A(p) ⇒ ((B(p) ⇒ C(p)) ⋀ (D(p) ⇒ ¬ C(p))) 37 Tuesday, October 22, 13

State-Structure Exploration ...and semantics is given as predicate updates, ... A’(x) = A(x) ⋁ ∃ y. C(y) ⋀ B(q, p) 𝜐 [action] ≡ B’(x, y) = B(x, y) ⋁ (C(x) ⋀ D(y)) C’(x) = ... D’(x) = ... 38 Tuesday, October 22, 13

State-Structure Exploration ...then abstract space and transformers can be generated automatically [Sagiv ’99] Q 39 Tuesday, October 22, 13

State-Structure Exploration ...then abstract space and transformers can be generated automatically [Sagiv ’99] 𝜐 [action]# Q# 𝛽 𝛽 𝜐 [action] Q 39 Tuesday, October 22, 13

Capsicum Semantics A A D Q ≡ 1. B B C A’(x) = A(x) ⋁ ∃ y. C(y) ⋀ B(q, p) 𝜐 [action] ≡ 2. B’(x, y) = B(x, y) ⋁ (C(x) ⋀ D(y)) C’(x) = ... D’(x) = ... 40 Tuesday, October 22, 13