User-Level Sandboxing with User-Level Sandboxing with FUSEFUSE

User-Level Sandboxing with User-Level Sandboxing with FUSEFUSE

Brandon RichBrandon RichAndrew BlaichAndrew Blaich

Brandon RichBrandon RichAndrew BlaichAndrew Blaich

University of Notre DameCSE 60641

ProblemProblemProblemProblem

Protect the file system from abuse. Guiding Principles:

Transparency Isolation User input

Protect the file system from abuse. Guiding Principles:

Transparency Isolation User input

SolutionSolutionSolutionSolution

System Call Interposition Intercept Analyze Re-route and log activity Return

Post-execution commit Using log and execution cache

System Call Interposition Intercept Analyze Re-route and log activity Return

Post-execution commit Using log and execution cache

ComponentsComponentsComponentsComponents

FUSE Syscall interposition (free) Logger Sandbox

Whole-file copy

Virtual File List Commit process

Uses log and .sandbox files

FUSE Syscall interposition (free) Logger Sandbox

Whole-file copy

Virtual File List Commit process

Uses log and .sandbox files

USER-Space

Kernel

FUSE

System-Call

/tmp file1.txt file1.txt.sandbox file2.doc

OpenReadWriteClose

log call in: log.log

3 Cases:

1) Writing a new file2) Writing an existing file3) Reading

Virtual File ListVirtual File List

Sandboxing WritesSandboxing Writes

Sandboxing WritesSandboxing Writes

Sandboxing DeletesSandboxing Deletes

No deletes ever take place VFL entry can be designated “deleted” Version numbers keep track of future

generations of a file

No deletes ever take place VFL entry can be designated “deleted” Version numbers keep track of future

generations of a file

Hiding Sandbox FilesHiding Sandbox Files

LoggingLogging

CommitterCommitter

Performance EvaluationPerformance Evaluation

Tests Andrew Benchmark Chirp Benchmark Custom Benchmarks

Three Environments Unmodified ext3 file system “Clean” FUSE Sandboxing FUSE

Tests Andrew Benchmark Chirp Benchmark Custom Benchmarks

Three Environments Unmodified ext3 file system “Clean” FUSE Sandboxing FUSE

Andrew BenchmarkAndrew Benchmark

(Compile Phase 5: Am-utils)

Chirp BenchmarkChirp Benchmark

Overhead of Logging vs SandboxingOverhead of Logging vs Sandboxing

Chirp Benchmark

Custom BenchmarkCustom Benchmark

ConclusionsConclusions

System call interposition at the user level is expensive

Disk-based caching is simple but robust Our approach is effective but could be

improved

System call interposition at the user level is expensive

Disk-based caching is simple but robust Our approach is effective but could be

improved

Questions?Questions?