Sealing OS processes to improve dependability and safety

Abstract

In most modern operating systems, a process is a hardware-protected abstraction for isolating code and data. This protection, however, is selective. Many common mechanisms---dynamic code loading, run-time code generation, shared memory, and intrusive system APIs---make the barrier between processes very permeable. This paper argues that this traditional open process architecture exacerbates the dependability and security weaknesses of modern systems. As a remedy, this paper proposes a sealed process architecture , which prohibits dynamic code loading, self-modifying code, shared memory, and limits the scope of the process API. This paper describes the implementation of the sealed process architecture in the Singularity operating system, discusses its merits and drawbacks, and evaluates its effectiveness. Some benefits of this sealed process architecture are: improved program analysis by tools, stronger security and safety guarantees, elimination of redundant overlaps between the OS and language runtimes, and improved software engineering. Conventional wisdom says open processes are required for performance; our experience suggests otherwise. We present the first macrobenchmarks for a sealed-process operating system and applications. The benchmarks show that an experimental sealed-process system can achieve performance competitive with highly-tuned, commercial, open-process systems.

Incinerator -- Eliminating Stale References in Dynamic OSGi Applications

“…The Multitasking Virtual machine [6], Android [20], Singularity [8,13] and KaffeOS [1] are examples of application frameworks where processes are fully isolated. Isolation is either achieved at the operating system level by using distinct address spaces or at the process level by using a single address space, but by preventing process to share objects.…”

FLORA: a framework for decomposing software architecture to introduce local recovery

“…Mach kernel [27] also provides a micro-kernel architecture and flexible multiprocessing support, which can be exploited for failure resilience and isolation. Singularity [8] proposes multiprocessing support in particular to improve dependability and safety by introducing the concept of sealed process architecture. This architecture limits the scopes of processes and their capabilities with respect to memory alteration for better isolation.…”

“…Isolation is usually supported by either the operating system (e.g. process isolation [8]) or a middleware (e.g. encapsulation of Enterprise Java Bean objects) and the existing design (i.e.…”

Authorizing applications in singularity

“…Many cases in which a computation must execute under more than one identity can be implemented in our design by spawning multiple processes. The reasonably fast process creation in Singularity [18] makes such an approach practical. Nonetheless, Singularity also provides a restricted mechanism for delegating authority that is then associated with a specific channel.…”