Userspace programs depend heavily on operating system resources to execute correctly, with file access being one of the most common and critical use cases. Modern Linux distributions include a vast number of files, many of which are unnecessary for the operation of most programs. However, existing access control mechanisms typically enforce coarse-grained policies that allow programs to access far more files than they actually require. This over-permissiveness significantly increases the system’s attack surface, exposing sensitive resources to potential exploitation.In this paper, we introduce AMPLE (Automated MAC PoLicy Extraction), a versatile tool that integrates both static and dynamic analysis to identify the files required by server applications. Ample accomplishes this by leveraging the distinct phases of server application execution, extracting runtime-dependent file paths by executing only the program’s initialization phase. This novel approach addresses the limitations of relying exclusively on static analysis, which fails to identify runtime-dependent file paths, as well as the shortcomings of purely dynamic analysis, which overlooks file paths accessed in non-executed code paths. To demonstrate its effectiveness, we evaluated Ample on ten widely-used server applications. The results show that Ample significantly reduces the number of accessible files, achieving an average reduction of over 99%, and limiting access to an average of fewer than 254 files per application. This substantial reduction helps restrict access to numerous security-critical files and mitigates 13 Linux kernel CVEs.

Configuration options allow users to customize application features according to the desired requirements. While the code that corresponds to disabled features is never executed, it still resides in process memory and comprises part of the application's attack surface, e.g., it can be reused for the construction of exploit code. Automatically reducing the attack surface of disabled application features according to a given configuration is thus a desirable defense-in-depth capability. The intricacies of modern software design and the complexities of popular programming languages, however, introduce significant challenges in automatically deriving the mapping of configuration options to their corresponding application code.

Linux enables non-root users to perform certain privileged operations through the use of the setuid (“set user ID”) mechanism. This represents a glaring violation of the principle of least privilege, as setuid programs run with full superuser privileges—with disastrous outcomes when vulnerabilities are found in them. Linux capabilities aim to improve this situation by splitting superuser privileges into distinct units that can be assigned individually. Despite the clear benefits of capabilities in reducing the risk of privilege escalation, their actual use is scarce, and setuid programs are still prevalent in modern Linux distributions. The lack of a systematic way for developers to identify the capabilities needed by a given program is a contributing factor that hinders their applicability.

Attackers leverage memory corruption vulnerabilities to establish primitives for reading from or writing to the address space of a vulnerable process. These primitives form the foundation for code-reuse and data-oriented attacks. While various defenses against the former class of attacks have proven effective, mitigation of the latter remains an open problem. In this paper, we identify various shortcomings of the x86 architecture regarding memory isolation, and leverage virtualization to build an effective defense against data-oriented attacks. Our approach, called xMP, provides (in-guest) selective memory protection primitives that allow VMs to isolate sensitive data in user or kernel space in disjoint xMP domains. We interface the Xen altp2m subsystem with the Linux memory management system, lending VMs the flexibility to define custom policies. Contrary to conventional approaches, xMP takes advantage of virtualization extensions, but after initialization, it does not require any hypervisor intervention. To ensure the integrity of in-kernel management information and pointers to sensitive data within isolated domains, xMP protects pointers with HMACs bound to an immutable context, so that integrity validation succeeds only in the right context. We have applied xMP to protect the page tables and process credentials of the Linux kernel, as well as sensitive data in various user-space applications. Overall, our evaluation shows that xMP introduces minimal overhead for real-world workloads and applications, and offers effective protection against data-oriented attacks.