CapAssess: An Endeavor to Assess and Enhance Linux Capabilities Utilization
The Linux capabilities mechanism divides the root privileges to provide more fine-grained access control, but its effectiveness depends on proper implementation and configuration. Our research reveals potential issues that can simplify privilege escalation attacks, highlighting the need for a comprehensive assessment of this security feature. The scattered enforcement of capabilities in the kernel and its sporadic usage in programs pose challenges in gathering assessment information. To address this, we propose three tools for diagnosing potential problems in its design, implementation, and utilization. First, we employ LLVM/Clang to examine the capabilities enforcement in the kernel to map capabilities checks to files. This is the first attempt to explore the interaction between capabilities and other mechanisms, such as UGO. Second, We propose a pattern-based method to identify the sensitive kernel functions protected by capabilities, quantifying the overlap problem of capabilities. Third, we employ a customized fuzzing approach to determine the minimal set of capabilities required by programs, offering insight for secure usage. Additionally, Our study is further guided by international access management standards, providing structured criteria for the assessment. Leveraging data collected by our tools, we identify imperfections of capabilities and reported to stakeholders. To the best of our knowledge, this is the first systematic assessment of Linux capabilities.
Thu 6 MarDisplayed time zone: Eastern Time (US & Canada) change
16:00 - 17:00 | Software EcosystemJournal First Track / Early Research Achievement (ERA) Track / Research Papers at M-2101 Chair(s): Chris Parnin Microsoft | ||
16:00 15mTalk | CapAssess: An Endeavor to Assess and Enhance Linux Capabilities Utilization Research Papers Jingzi Meng Institute of Information Engineering, Chinese Academy of Sciences, Yuewu Wang University of Chinese Academy of Sciences, Lingguang Lei Institute of Information Engineering, Chinese Academy of Sciences, Jiwu Jing University of Chinese Academy of Sciences, Pingjian Wang Institute of Information Engineering, Chinese Academy of Sciences, Chunjing Kou University of Chinese Academy of Sciences, Wang Peng University of Chinese Academy of Sciences | ||
16:15 7mTalk | Service Extraction from Object-Oriented Monolithic Systems: Supporting Incremental Migration Early Research Achievement (ERA) Track Soufyane Labsari Université Lille, CNRS, Centrale Lille, Inria, UMR 9189 - CRIStAL, Imen Sayar Univ. Lille, CNRS, Inria, Centrale Lille, UMR 9189 CRIStAL, F-59000 Lille, France, Nicolas Anquetil University of Lille, Lille, France, Benoit Verhaeghe Berger-Levrault, Anne Etien Université de Lille, CNRS, Inria, Centrale Lille, UMR 9189 –CRIStAL | ||
16:22 15mTalk | GitHub Marketplace for Automation and Innovation in Software Production Journal First Track Sk Golam Saroar York University, Waseefa Ahmed York University, Elmira Onagh York University, Maleknaz Nayebi York University | ||
16:37 15mTalk | Protect Your Secrets: Understanding and Measuring Data Exposure in VSCode Extensions Research Papers Pre-print | ||