Restraining Execution Environments

Transcription

1 Restraining Execution Environments Segurança em Sistemas Informáticos André Gonçalves

2 Contents Overview Java Virtual Machine: Overview The Basic Parts Security Sandbox Mechanisms Sandbox Memory Native Methods Structured Error Handling Conclusion CHROOT: Overview Uses Limitations Conclusion Final Conclusion

3 Overview Restraining execution environments are used to protect the system from running programs against security threats. Deny the access to files or resources or emulates them. There are different types of restraining environments with different purposes.

4 JVM - Overview Java Virtual Machines operate on Java bytecodes. The bytecodes can be generated from many programming languages but is normally generated from Java. Available for many hardware and software implementations. The JVM runtime executes.class or.jar files, emulating the JVM instruction set by interpreting it, using a just-in-time compiler (JIT), or using an ahead-of-time compiler. Stack-based architecture. JVM is the instance of Java Runtime Environment (JRE).

5 JVM Overview (2)

6 JVM The Basic Parts A set of registers A stack An execution environment A garbage-collected heap A constant pool A method storage area An instruction set

7 JVM - Security JVM is an apropriate technology for network environments especially when files are downloaded across the network and executed locally. Provides a customizable sandbox where code is executed and allowed to do anything. The code can do nothing outside its sandbox. By making it impossible for downloaded code to perform certain actions, Java's security model protects the user from the threat of hostile code.

8 JVM Sandbox Mechanisms Safety sandbox mechanisms: Type-safe reference casting Structured memory access (no pointer arithmetic) Automatic garbage collection (can't explicitly free allocated memory) Array bounds checking Checking references for null

9 JVM Sandbox Memory A program that corrupts memory, crashes, and possibly causes other programs to crash represents one kind of security breach. Unrestrained memory access would be a security risk because a cracker could, potentially, use the memory to subvert the security system. Another safety feature is the unspecified manner in which the runtime data areas are laid out inside the Java virtual machine so a cracker never knows which areas will be used.

10 JVM Native Methods Native methods can be used to implement some funcionalities that Java API does not implement. A security issue can result from allowing native methods to execute. The security manager includes a method that establishes whether or not a program can load dynamic libraries, which are necessary for invoking native methods. The security model for native methods therefore is the traditional approach to computer security: You have to trust a native method before you call it.

11 JVM Structured Error Handling Contributes to security by using structured error handling with exceptions. When a violation occurs, instead of crashing, the JVM can throw an exception or an error, which may result in the death of the thread but shouldn t crash the system. Almost always results in the death of the thread. If the program has other threads doing useful things, those threads may be able to carry on without their recently departed colleague. Encourages programmers to write code that actually handles exception conditions that may reasonably be expected to arise as their programs run.

12 JVM - Conclusion The sandbox security model is an intrinsic part of Java's architecture. The sandbox, a shell that surrounds a running Java program, protects the host system from malicious code. This security model helps give users confidence in downloading untrusted code across network.

13 CHROOT - Overview Used on UNIX operating systems. Changes the aparent disk root directory to a chroot jail. Used for unstrusted programs. A chroot jail presents a dramatically restricted view of the filesystem to an application, and usually far fewer system privileges.

14 CHROOT - Uses Testing and development. Dependency control. Compatibility. Recovery. Privilege separation. Honeypotting.

15 CHROOT - Limitations Superuser can always escape (by typing "exit") from chroot prison. At startup, programs expect to find certain files which must be present in the chroot jail in order for the program to startup successfully. Only the root user can perform a chroot. The chroot mechanism is not intended to defend against intentional tampering by privileged (root) users. The chroot mechanism in itself also is not intended to restrict the use of resources like I/O, bandwidth, disk space or CPU time.

16 CHROOT - Conclusion Chroot is intended to protect against access to unauthorized files. Available in all linux distributions. Does not prevent access to system resources.

17 Final Conclusion The JVM and chroot are suitable for distinct situations. JVM is used to prevent access to the complete system. Chroot is used to prevent access to folders and files.

18 Bibliography Inside the Java Virtual Machine Bill Venners McGraw-Hill - ISBN:

19 Questions