Application-level isolation and recovery with solitude

Operating Systems Review (ACM)

Volumn 42, Issue 4, 2008, Pages 95-107

  Jain, Shvetank ^a   Shafique, Fareha ^a   Djeric, Vladan ^a   Goel, Ashvin ^a  

^a UNIVERSITY OF TORONTO   (Canada)

Author keywords

Access control; Copy on write; File systems; Recovery; Taint analysis; Transactional file system

Indexed keywords

CASCADING EFFECTS; DATA DEPENDENCIES; ENTIRE SYSTEM; ERROR-PRONE PROCESS; FILE SHARING; FILE SYSTEMS; FILESYSTEM; INTRUSION ANALYSIS; INTRUSION RECOVERY; NAMESPACES; OPERATING SYSTEMS; PERSISTENT STATE; RECOVERY SYSTEMS;

ACCESS CONTROL; COMPUTER OPERATING SYSTEMS; DATA FLOW ANALYSIS; FILE ORGANIZATION; RECOVERY; SECURITY SYSTEMS;

COMPUTER SYSTEM RECOVERY;

EID: 77950815572     PISSN: 01635980     EISSN: None     Source Type: Conference Proceeding    
DOI: 10.1145/1357010.1352603     Document Type: Conference Paper

References (39)

1. Brian Cornell, Peter Dinda, and Fabián Bustamante. Wayback: A user-level versioning file system for linux. In Proceedings of the USENIX Technical Conference, pages 19-28, June 2004.
2. Microsoft Corporatin. Microsoft SoftGrid. http://www.microsoft.com/ systemcenter/ softgrid/evaluation/virtualization.mspx, 2007.
3. Manuel Costa, Jon Crowcroft, Miguel Castro, Antony Rowstron, Lidong Zhou, Lintao Zhang, and Paul Barham. Vigilante: end-to-end containment of internet worms. In Proceedings of the Symposium on Operating Systems Principles (SOSP), pages 133-147, 2005.
4. Steve Friedl. Best practices for UNIX chroot() operations. http://www.unixwiz.net/techtips/ chroot-practices.html, January 2002.
5. Ashvin Goel, Wu chang Feng, Wu chi Feng, David Maier, and Jim Snow. Automatic high-performance reconstruction and recovery. Journal of Computer Networks, 51(5):1361-1377, April 2007. From Intrusion Detection to Self-Protection.
6. Ashvin Goel, Kenneth Po, Kamran Farhadi, Zheng Li, and Eyal de Lara. The Taser intrusion recovery system. In Proceedings of the Symposium on Operating Systems Principles (SOSP), October 2005.
7. Roger Haskin, Yoni Malachi, Wayne Sawdon, and Gregory Chan. Recovery management in QuickSilver. ACM Transactions on Computer Systems, 6(1):82-108, 1988.
8. Matt Hines. Google buys into security, acquires GreenBorder. http://www.infoworld.com/article/07/05/29/ Google-buys-into-AV\-1.html, May 2007.
9. Francis Hsu, Hao Chen, Thomas Ristenpart, Jason Li, and Zhendong Su. Back to the future: A framework for automatic malware removal and system repair. In Proceedings of the Annual Computer Security Applications Conference, December 2006.
10. Trent Jaeger, Reiner Sailer, and Xiaolan Zhang. Analyzing integrity protection in the SELinux example policy. In Proceedings of the USENIX Security Symposium, pages 59-74, August 2003.
11. Poul-Henning Kamp and R.N.M. Watson. Jails: Confining the omnipotent root. In Proceedings of the Second International SANE Conference, 2002.
12. Samuel T. King and Peter M. Chen. Backtracking intrusions. In Proceedings of the Symposium on Operating Systems Principles (SOSP), pages 223-236, October 2003.
13. John Leyden. Spyware poses as Firefox extension. urlhttp://www. theregister.co.uk/2006/07/26/ firefox-malware-extension, July 2006.
14. Ninghui Li, Ziqing Mao, and Hong Chen. Usable mandatory integrity protection for operating systems. In Proceedings of the IEEE Symposium on Security and Privacy, pages 164-178, 2007. (Pubitemid 47432524)
15. Linux. Man capabilities(7) in Linux man page. Confirming to POSIX.1e.
16. Peter Loscocco and Stephen Smalley. Integrating flexible support for security policies into the linux operating system. In Proceedings of the Freenix Track of USENIX Technical Conference, June 2001.
17. Bharat Mediratta. Gallery photo album organizer. http://gallery.menalto. com/, 2004.
18. James Newsome and Dawn Song. Dynamic taint analysis for automatic detection, analysis, and signature generation of exploits on commodity software. In Proceedings of the Network and Distributed System Security Symposium, February 2005.
19. Zachary N.J. Peterson and Randal Burns. Ext3cow: A time-shifting file system for regulatory compliance. ACM Transactions on Storage, 1(2):190-212, May 2005.
20. Ben Pfaff, Tal Garfinkel, and Mendel Rosenblum. Virtualization aware file systems: Getting beyond the limitations of virtual disks. In Proceedings of the Networked Systems Design and Implementation (NSDI), May 2006.
21. Rob Pike, Dave Presotto, Ken Thompson, Howard Trickey, and Phil Winterbottom. The use of name spaces in Plan 9. ACM Operating Systems Review, 27(2):72-76, 1993.
22. Daniel Price and Andrew Tucker. Solaris zones: Operating system support for consolidating commercial workloads. In Proceedings of the USENIX Large Installation Systems Administration Conference, 2004.
23. Drew Roselli, Jacob R. Lorch, and Thomas E. Anderson. A comparison of file system workloads. In Proceedings of the USENIX Technical Conference, June 2000.
24. A. Sabelfeld and A. Myers. Language-based information-flow security. IEEE Journal on Selected Areas in Communications, 21(1):5-19, January 2003.
25. Douglas S. Santry, Michael J. Feeley, Norman C. Hutchinson, Alistair C. Veitch, Ross W. Carton, and Jacob Ofir. Deciding when to forget in the Elephant file system. In Proceedings of the Symposium on Operating Systems Principles (SOSP), pages 110-123, December 1999.
26. Secure chroot barrier - Linux-Vserver. http: //linux-vserver.org/Secure- chroot-Barrier, viewed in Aug 2007.
27. Fareha Shafique. Application-level file system isolation. Master's thesis, University of Toronto, December 2007.
28. Stephen Soltesz, Herbert Pötzl, Marc E. Fiuczynski, Andy Bavier, and Larry Peterson. Container-based operating system virtualization: A scalable, high-performance alternative to hypervisors. In Proceedings of the EuroSys conference, pages 275-287, 2007.
29. G. Edward Suh, Jae W. Lee, David Zhang, and Srinivas Devadas. Secure program execution via dynamic information flow tracking. In Proceedings of the International Conference on Architectural Support for Programming Languages and Operating Systems, pages 85-96, 2004.
30. Weiqing Sun, Zhenkai Liang, R. Sekar, and V.N. Venkatakrishnan. One-way Isolation: An Effective Approach for Realizing Safe Execution Environments. In Proceedings of the Network and Distributed System Security Symposium, February 2005.
31. Miklos Szeredi. File system in user space (FUSE). http://fuse. sourgeforge.net.
32. Douglas B. Terry, Marvin M. Theimer, Karin Petersen, Alan J. Demers, Mike J. Spreitzer, and Carl H. Hauser. Managing update conflicts in Bayou, a weakly connected replicated storage system. In Proceedings of the 15th Symposium on Operating Systems Principles (SOSP), pages 172-183, December 1995.
33. David Thiel. Exposing vulnerabilities in media software. Black Hat USA 2007, http://www.blackhat.com/html/ bh-usa-07/bh-usa-07-speakers.html#thiel, August 2007.
34. Surendra Verma and Charles Torre. Vista transactional file system, December 2005. http://channel9.msdn.com/Showpost. aspx?postid=142120.
35. Werner Vogels. File system usage in Windows NT 4.0. In Proceedings of the Symposium on Operating Systems Principles (SOSP), December 1999.
36. David Wagner and Dean Tribble. A security architecture of the combex darpabrowser architecture, March 2002. http://www.combex.com/papers/darpa- review/ security-review.pdf.
37. Andy Watson and Paul Benn. Multiprotocol Data Access: NFS, CIFS, and HTTP. Technical Report TR3014, Network Appliance, Inc., 1999. http://www.netapp.com/tech-library/3014.html.
38. Nickolai Zeldovich, Silas Boyd-Wickizer, Eddie Kohler, and David Mazières. Making information flow explicit in HiStar. In Proceedings of the Operating Systems Design and Implementation (OSDI), November 2006.
39. Ningning Zhu and Tzi-Cker Chiueh. Design, implementation, and evaluation of repairable file service. In Proceedings of the IEEE Dependable Systems and Networks, pages 217-226, June 2003.