SANER 2025
Tue 4 - Fri 7 March 2025 Montréal, Québec, Canada
Thu 6 Mar 2025 16:00 - 16:15 at M-2101 - Software Ecosystem Chair(s): Chris Parnin

The Linux capabilities mechanism divides the root privileges to provide more fine-grained access control, but its effectiveness depends on proper implementation and configuration. Our research reveals potential issues that can simplify privilege escalation attacks, highlighting the need for a comprehensive assessment of this security feature. The scattered enforcement of capabilities in the kernel and its sporadic usage in programs pose challenges in gathering assessment information. To address this, we propose three tools for diagnosing potential problems in its design, implementation, and utilization. First, we employ LLVM/Clang to examine the capabilities enforcement in the kernel to map capabilities checks to files. This is the first attempt to explore the interaction between capabilities and other mechanisms, such as UGO. Second, We propose a pattern-based method to identify the sensitive kernel functions protected by capabilities, quantifying the overlap problem of capabilities. Third, we employ a customized fuzzing approach to determine the minimal set of capabilities required by programs, offering insight for secure usage. Additionally, Our study is further guided by international access management standards, providing structured criteria for the assessment. Leveraging data collected by our tools, we identify imperfections of capabilities and reported to stakeholders. To the best of our knowledge, this is the first systematic assessment of Linux capabilities.

Thu 6 Mar

Displayed time zone: Eastern Time (US & Canada) change

16:00 - 17:00
16:00
15m
Talk
CapAssess: An Endeavor to Assess and Enhance Linux Capabilities Utilization
Research Papers
Jingzi Meng Institute of Information Engineering, Chinese Academy of Sciences, Yuewu Wang University of Chinese Academy of Sciences, Lingguang Lei Institute of Information Engineering, Chinese Academy of Sciences, Jiwu Jing University of Chinese Academy of Sciences, Pingjian Wang Institute of Information Engineering, Chinese Academy of Sciences, Chunjing Kou University of Chinese Academy of Sciences, Wang Peng University of Chinese Academy of Sciences
16:15
7m
Talk
Service Extraction from Object-Oriented Monolithic Systems: Supporting Incremental Migration
Early Research Achievement (ERA) Track
Soufyane Labsari Université Lille, CNRS, Centrale Lille, Inria, UMR 9189 - CRIStAL, Imen Sayar Univ. Lille, CNRS, Inria, Centrale Lille, UMR 9189 CRIStAL, F-59000 Lille, France, Nicolas Anquetil University of Lille, Lille, France, Benoit Verhaeghe Berger-Levrault, Anne Etien Université de Lille, CNRS, Inria, Centrale Lille, UMR 9189 –CRIStAL
16:22
15m
Talk
GitHub Marketplace for Automation and Innovation in Software Production
Journal First Track
Sk Golam Saroar York University, Waseefa Ahmed York University, Elmira Onagh York University, Maleknaz Nayebi York University
16:37
15m
Talk
Protect Your Secrets: Understanding and Measuring Data Exposure in VSCode Extensions
Research Papers
Yue Liu Monash University, Kla Tantithamthavorn Monash University, Li Li Beihang University
Pre-print