Tolerating Malicious Device Drivers in Linux
Name
Zeldovich_Tolerating malicious.pdf
Size
184.31 KB
Format
Adobe PDF
Checksum (MD5)
845831cbb207165a576c59291415dca0
Author(s)
Boyd-Wickizer, Silas
Zeldovich, Nickolai
Date Issued
June 2010
Journal
2010 USENIX Annual Technical Conference
Publisher
USENIX Association
Citation
Boyd-Wickizer, Silas and Nickolai Zeldovich. "Tolerating Malicious Device Drivers in Linux" USENIX Annual Technical Conference, June 23–25, 2010, Boston, MA, USA.
Version
Author's final manuscript
Abstract
This paper presents SUD, a system for running existing
Linux device drivers as untrusted user-space processes.
Even if the device driver is controlled by a malicious
adversary, it cannot compromise the rest of the system.
One significant challenge of fully isolating a driver is to
confine the actions of its hardware device. SUD relies on
IOMMU hardware, PCI express bridges, and message-signaled
interrupts to confine hardware devices. SUD
runs unmodified Linux device drivers, by emulating a
Linux kernel environment in user-space. A prototype of
SUD runs drivers for Gigabit Ethernet, 802.11 wireless,
sound cards, USB host controllers, and USB devices, and
it is easy to add a new device class. SUD achieves the
same performance as an in-kernel driver on networking
benchmarks, and can saturate a Gigabit Ethernet link.
SUD incurs a CPU overhead comparable to existing runtime
driver isolation techniques, while providing much
stronger isolation guarantees for untrusted drivers. Finally,
SUD requires minimal changes to the kernel—just two
kernel modules comprising 4,000 lines of code—which
may at last allow the adoption of these ideas in practice.
Description
URL to paper from conference site
MIT Department
Massachusetts Institute of Technology. Department of Electrical Engineering and Computer Science
Terms of Use
Creative Commons Attribution-Noncommercial-Share Alike 3.0
Persistent DSpace Link
DOI of Published Version
http://www.usenix.org/events/atc10/tech/full_papers/Boyd-Wickizer.pdf
