Towards Automated Privilege Separation

Abstract

Abstract. Applications are subject to threat from a number of attack vectors, and limiting their attack surface is vital. By using privilege separation to constrain application access to protected resources, we can mitigate the threats against the application. Previous examinations of privilege separation either entailed significant manual effort or required access to the source code. We consider a method of performing privilege separation through black-box analysis. We consider similar applications to the target and infer states of execution, and determine unique trigger system calls that cause transitions. We use these for the basis of statebased policy enforcement by leveraging the Systrace policy enforcement mechanism. Our results show that we can infer state transitions with a high degree of accuracy, while our modifications to Systrace result in more granular protection by limiting system calls depending on the application's state. The modified Systrace increases the size of the Apache web server's policy file by less than 17.5%.

Adaptive defenses for commodity software through virtual application partitioning

“…It is also more limited, as the partitions are more rigidly defined. Bapat et al [3] investigate the automatic specification of the privileged Systrace segments using black box analysis. Similarly to Systrace, the Privman library [21] provides a systematic and reusable approach for partitioning operations that require higher privileges through the provided API.…”