🤖 AI Summary
This work addresses the critical security vulnerability in traditional monolithic kernels, where a flaw in any single component can compromise the entire system. Existing isolation approaches often entail extensive kernel modifications or incur substantial performance overhead. To overcome these limitations, the authors propose a lightweight hardware-assisted isolation architecture that leverages extended page tables (EPT) and fine-grained access control policies to enforce strong inter-component isolation with minimal changes to the kernel source code. A sentinel function mechanism is introduced to efficiently validate cross-domain calls, thereby avoiding frequent and costly transitions into the hypervisor. Evaluation on the Linux networking stack and the igc network driver demonstrates that, when isolation boundaries are judiciously defined, the performance overhead for processing MTU-sized packets is negligible.
📝 Abstract
The monolithic nature of widely used commodity operating systems means that vulnerabilities in one software component potentially compromise the entire kernel. Formally verifying these systems, or redesigning them altogether as microkernels, according to the principle of least privilege, requires significant effort. Researchers have therefore considered compartmentalization techniques that minimize or totally avoid changes to existing systems. However, current approaches use techniques such as Memory Protection Keys (MPKs), necessitating extensive code analysis to ensure security, or use virtualization by instrumenting the kernel with calls to the glue code that switches compartments.
In this work, we present Pomegranate, a framework that uses hardware-assisted virtualization to securely compartmentalize an existing system with minimal to no modifications to its source code. Allowed interactions between compartments are defined using an access-control policy and strictly enforced using Extended Page Tables. Using special sentry functions, Pomegranate is able to check all cross-compartment transitions without trapping into the hypervisor. We demonstrate the efficacy of Pomegranate on a compartmentalized Linux network stack using the igc NIC driver. Experiments show the overheads of our approach are negligible at MTU-sized packets when compartment boundaries are carefully established to avoid excessive inter-compartment communication.