Operating Systems Security

Question 1

Characteristics of Trusted Computed Base

Answer 1

Tamper proof
Complete mediation
Correctness

Question 2

How does the OS isolate itself from untrusted user code?

Answer 2

Hardware support for memory protection
Processor execution modes
Privileged instructions which can only execute in system mode
System calls to transfer control between system and user

Question 3

What does the operating system do?

Answer 3

Provides abstractions for resources such as address space and files
Controls access to hardware
Isolates processes/applications

Question 4

Characteristics of Address Space

Answer 4

Processes view memory as contiguous
Often appears larger than available physical memory
Each process has its own memory mapping

Question 5

What is address translation?

Answer 5

Logical virtual addresses/pages are mapped to memory frames

Sharing mappings must be explicit and mediated by OS

Question 6

What is MMU?

Answer 6

Memory management unit

Question 7

Process protection via MMU

Answer 7

Uses page tables to resolve virtual addresses to physical addresses
Access marked by RWX bits on pages
Non executable stack also helps protect from malicious code execution

Question 8

How does the OS isolate application code?

Answer 8

OS resides in portion of each process’ address space

Processes can access other processes/hardware/kernel in limited ways

Question 9

What is the structure of application code in 32bit Linux?

Answer 9

Lower 3GB is for user code/data

Top 1GB for kernel

Question 10

How does complete mediation work?

Answer 10

All protected resources need to be requested via TCB
User code can’t change OS’s address space without changing to system mode
To access physical resources, need privileged instructions from system mode
OS virtualizes physical resources, provides API to access
File tracks persistent changes

Question 11

How does virtualization help?

Answer 11

Localizes the damage done to a compromised OS

TCB acts as hypervisor

Question 12

What is the idea behind correctness?

Answer 12

Smaller and simpler coding is good

Secure coding is good for OS (use type safe languages)

Question 13

How can the TCB be trusted?

Answer 13

Secure vs trusted vs high assurance
Set of all hardware and software trusted to operate securely
Required for all others to trust in the system security policy

Question 14

How do we trust software?

Answer 14

• Functional correctness
• Maintain data integrity
• Protect disclosure of sensitive data
• Confidence
• Statement given security we expect system to enforce

Question 15

What are the TCB design principles?

Answer 15

• Least privilege for user and programs
• Economy (small code size)
• Open design
• Complete mediation
• Fail-safe defaults
• Ease of use

Question 16

How do we build a TCB?

Answer 16

• Support key security features (authentication, access control, MAC, DAC, protecting the OS)
• Complete mediation of accesses (trusted path from user to secure system)
• Audit logs showing object accesses

Question 17

How should we design the kernel to be secure?

Answer 17

• Good isolation (small in size)
• Reference monitor
• Tamper proof
• Unbypassable
• Analyzable

Question 18

Why is the kernel useful to security?

Answer 18

Security kernel enforces all security mechanisms

Question 19

Kernel design and TCB work together

Answer 19

All parts needed to enforce security policy

Virtualization also helps

Question 20

What is assurance?

Answer 20

Ways to say that everything is okay

Question 21

How do we provide assurance?

Answer 21

• Testing (regression testing)
• Penetration testing
• Formal verification (checking mathematical specification of a problem to ensure security assertions hold)
• Meeting requirements

Question 22

What are the challenges with testing?

Answer 22

Hard to cover all use cases

Cannot demonstrate the absence of a problem