Restriction of program process capabilities

• US 8,635,663 B2
• Filed: 08/22/2012
• Issued: 01/21/2014
• Est. Priority Date: 08/04/2006
• Status: Active Grant

• Current Assignee: Apple Inc.
• Original Assignee: Apple Inc.
• Inventors: Cooper, Simon, Lane-Smith, Nick, Osborne, Joshua
• Primary Examiner(s): Gergiso, Techane
• Application Number:
  US13/591,690
• Publication Number:
  US 20130055341A1
• Time in Patent Office: 517 Days
• Field of Search: 726/1, 719/328
• US Class Current: 726/1
• CPC Class Codes: G06F 21/53 by executing in a restricted environment, e.g. sandbox or secure virtual machine
• CPC Class Codes: G06F 21/6281 at program execution time, where the protection is within the operating system
• CPC Class Codes: G06F 2221/033 Test or assess software
• CPC Class Codes: G06F 2221/2141 Access rights, e.g. capability lists, access control lists, access tables, access matrices
• CPC Class Codes: G06F 2221/2149 Restricted operating environment

Abstract

This document describes systems and methods for restricting program process capabilities. In some implementations, the capabilities are restricted by limiting the rights or privileges granted to an application. A plurality of rules may be established for a program, or for a group of programs, denying that program the right to take actions which are outside of the actions needed to implement its intended functionality. A security policy is implemented to test actions initiated in response to an application against the rules to enable decisions restricting the possible actions of the program. Embodiments are disclosed which process the majority of decisions regarding actions against a security profile through use of a virtual machine. In some embodiments, the majority of decisions are resolved within the kernel space of an operating system.

Claims

1. A method of operating a computing device having an operating system defining kernel space and user space, comprising the acts of:

causing a program to be operated by the computing device, the program having a plurality of intended functionalities, the program further having a security profile associated therewith, the security profile including a set of policies;

monitoring calls attempted by the program, the monitoring performed by monitoring operations in the kernel initiated in response to the calls, the monitoring comprising intercepting a kernel operation at a point at which one or more arguments associated with the call have been resolved in the kernel for the kernel operation;

determining whether at least one intercepted kernel operation initiated in response to the program is consistent with the policies associated with the program,

wherein the security profile is directed to defer a permission decision to user space, and the determining comprises;

identifying a user space function referenced by a callback table in the kernel and located in user space to perform the permission decision, and

performing a procedure call to the user space function; and

allowing execution of the intercepted kernel operation when the call to the user space function indicates that the request is permitted.

2. The method of claim 1, wherein the act of determining whether an operation initiated in response to a program call is consistent with the policies associated with the program comprises correlating the intercepted kernel operation with the policies and determining if the attempted action is allowed by the policies.

3. The method of claim 2, wherein the act of monitoring is performed at least partially at the kernel level of the operating system.

4. The method of claim 3, wherein the program policies are loaded into memory in the kernel space of an operating system of the computing device.

5. The method of claim 1, wherein the program is an applications program.

6. A computing device, comprising:

a processing device configured to execute instructions, the instructions comprising;

an operating system, the operating system defining a kernel space and a user space;

at least one application implementable by the computing device;

a set of operational permissions accessible to the computing device and operatively associated with the application, the operational permissions comprising permissions representative of operations in the kernel space of the operating system that are permitted, so as to enable functions the application is allowed to perform;

a monitoring system adapted to monitor operations in the kernel space initiated in response to at least some system calls initiated by the application by intercepting the kernel operations before execution, wherein at least some kernel operations have resolved arguments associated with the operations;

a determination system configured to determine if the initiated kernel operations are to be permitted, the determination system adapted to make such determinations at least partially in response to the operational permissions for the application,

wherein the determination system comprises;

a virtual machine operating in the kernel space of the operating system, the virtual machine configured to test at least a portion of the initiated kernel operations against the operation permissions; and

a decision module operating at least in part in the user space and configured to receive decision instructions referred from the virtual machine and to resolve the referred decision instructions.

7. The computing device of claim 6, wherein the monitoring system and the determination system are implemented by the operating system of the computing device.

8. The computing device of claim 6, wherein the determination system operates at least in part in the kernel space of the operating system.

9. The computing device of claim 6, wherein the determination system comprises a virtual machine operating in the kernel space of the operating system.

10. A non-transitory machine readable medium containing instructions, which when executed by a processor machine, cause operations to be performed which comprise the following:

monitoring at least some actions attempted by an application running on the machine by intercepting kernel operations initiated in response to actions initiated by the application;

functionally correlating at least one of the kernel operations initiated in response to the application to at least one of a plurality of predetermined policies for the application, the plurality of policies containing at least a first policy indicative of an operation which is necessary for the application to provide a predetermined functionality;

gating at least one monitored action of the application at least partially in response to the functional correlation of the kernel operation with the first policy, wherein gating comprises;

deferring a permission decision to user space, wherein a compiled security profile refers to a callback table,

executing a procedure call to a function located in user space and found in the table to perform the permission decision for the kernel operation, and

allowing execution of the monitored action if the permission decision is to allow the kernel operation.

11. The machine readable medium of claim 10, wherein the operation of functionally correlating at least one of the kernel operations initiated in response to the application to at least one of a plurality of predetermined policies for the application, comprises the operation of:

implementing a virtual machine to execute compiled code representing the predetermined policies.

12. A method of implementing security containment for at least one selected application operated on a computing device, the computing device having an operating system having a kernel space and having user space, comprising the acts of:

accessing a plurality of policies, the policies indicative of processes for determining whether the application may complete selected system calls, by determining the permissibility of selected operations in the kernel initiated in response to the system calls;

identifying a system call initiated by the application, and trapping kernel operations initiated in response to the system call;

comparing the initiated kernel operations with the policies, without executing the kernel operations; and

in the operation that the initiated kernel operation is addressed by the policies, allowing or denying the execution of the kernel operation in accordance with the policies, wherein allowing or denying comprises;

deferring a permission decision to user space, wherein a compiled security profile refers to a callback table,

executing a remote procedure call to a function located in user space and found in the table to perform the permission decision for the kernel operation, and

allowing execution of the monitored action if the permission decision is to allow the kernel operation.

13. The method of claim 12, wherein the act of comparing initiated kernel operations with the policies comprises:

testing a first group of initiated kernel operations against the policies within the kernel space; and

testing a second group of initiated kernel operations against the policies by an extension module operating in user space, wherein the second group of initiated kernel operations comprise operations requiring user input to resolve.

14. The method of claim 13, wherein the policies identify initiated kernel operations which will be tested in the extension module.

15. The method of claim 12, wherein the step of comparing is performed by the computing device operating system at the kernel level.

16. The method of claim 12, wherein the application is a user-level application.

17. A method of providing security for a computer having an operating system and operating at least one user application, the operating system having a kernel space and a user space, and having an system level application program interface layer between the kernel space and the user space, the method comprising:

opening the user application on the computer;

communicating a notification to a monitoring module in the user space of the operating system that the program was opened; and

in response to the notification, placing a first profile for the program in the kernel layer of the operating system, the profile containing machine language operations for determining if certain operations initiated in the kernel in response to actions initiated by the application are to be allowed or denied;

using the profile to determine if the profile establishes a policy by which a first kernel operation is to be permitted or denied;

if the profile establishes a policy by which the first kernel operation is to be permitted or denied, permitting or denying the operation in accordance with the policy,

wherein the profile establishes that determination of a kernel operation referred to a decision process outside of the kernel to determine if the initiated kernel operation is to be permitted or denied.

18. The method of claim 17, wherein the decision process has the ability to ask the user for input affecting whether the initiated call is to be permitted or denied.