Visible to the public Reinventing the Privilege Drop: How Principled Preservation of Programmer Intent Would Prevent Security Bugs


Ira Ray Jenkins is a Ph.D. student in the Trust Lab at Dartmouth College. Working with Dr. Sean Smith and Dr. Sergey Bratus, his research is focused on security and trust throughout the software and hardware stack. Previous work includes Zigbee network protocol analysis, secure boot for resource constrained devices, and hardware-based trust within IoT networks.


The principle of least privilege requires that components of a program have access to only those resources necessary for their proper function. Defining proper function is a difficult task. Existing methods of privilege separation, like Control Flow Integrity and Software Fault Isolation, attempt to infer proper function by bridging the gaps between language abstractions and hardware capabilities. However, it is programmer intent that defines proper function, as the programmer writes the code that becomes law. Codifying programmer intent into policy is a promising way to capture proper function; however, often onerous policy creation can unnecessarily delay development and adoption.

In this paper, we demonstrate the use of our ELF-based access control (ELFbac), a novel technique for policy definition and enforcement. ELFbac leverages the common programmer’s existing mental model of scope, and allows for policy definition at the Application Binary Interface (ABI) level. We consider the roaming vulnerability found in OpenSSH, and demonstrate how using ELFbac would have provided strong mitigation with minimal program modification. This serves to illustrate the effectiveness of ELFbac as a means of privilege separation in further applications, and the intuitive, yet robust nature of our general approach to policy creation.



Creative Commons 2.5
Switch to experimental viewer