ECS 235A โ Scribe Notes โ 10/19/2007
Paul Congdon
Confinement:
1. How to confine a program so it will not violate security properties of the system
or other programs?
2. The Janus paper addresses the confinement problem.
3. Early Multi-tasking OSes had a similar problem.
4. The goal of confinement is to uphold
a. Confidentiality
b. Integrity
c. (and to a lesser degree) Availability
5. Confidentiality โ prevent the leak of confidential information
6. Integrity โ prevent an untrusted program from harming the system
7. Availability โ assure an untrusted program doesnโt use too many resources
Reference Monitors
1. An abstract mechanism for confinement approaches
2. Mediates access to objects and resources
3. Must posses the following properties:
a. Always invoked
b. Easily verifiable
Mechanisms for Confinement
1. OS Sandbox
a. Always invoked โ yes โ Janus can be always invoked
b. Easily verifiable โ yes, if implementation is simple and small such as
Janus
2. Virtual Machines
a. Always invoked โ yes
b. Easily verifiable โ more complex than sandboxes, but less complex than
the OS itself
3. Inline Reference Monitors โ can be applied selectively
a. Always invoked โ yes, but only on those applications or resources being
monitored
b. Easily verifiable โ may be circumvented because executing programs are
not type safe
Janus Paper Discussion
1. What is the threat model of Janus? What is trusted and untrusted?
a. Trusted elements
i. OS
