PoLPer: Process-Aware Restriction of Over-Privileged Setuid Calls in Legacy Applications

/in /by

Publication Date: 3/27/2019

Event: 9th ACM Conference on Data and Application Security and Privacy (CODASPY 2019)

Reference: pp. 209-220, 2019

Authors: Yuseok Jeon, NEC Laboratories America, Inc.; Purdue University; Junghwan Rhee, NEC Laboratories America, Inc.; Chung Hwan Kim, NEC Laboratories America, Inc.; Zhichun Li, NEC Laboratories America, Inc.; Mathis Payer, Purdue University; Byungyoung Lee, Purdue University; Zhenyu Wu, NEC Laboratories America, Inc.; Kangkook Jee, NEC Laboratories America, Inc.

Abstract: Setuid system calls enable critical functions such as user authentications and modular privileged components. Such operations must only be executed after careful validation. However, current systems do not perform rigorous checks, allowing exploitation of privileges through memory corruption vulnerabilities in privileged programs. As a solution, understanding which setuid system calls can be invoked in what context of a process allows precise enforcement of least privileges. We propose a novel comprehensive method to systematically extract and enforce least privilege of setuid system calls to prevent misuse. Our approach learns the required process contexts of setuid system calls along multiple dimensions: process hierarchy, call stack, and parameter in a process-aware way. Every setuid system call is then restricted to the per-process context by our kernel-level context enforcer. Previous approaches without process-awareness are too coarse-grained to control setuid system calls, resulting in over-privilege. Our method reduces available privileges even for identical code depending on whether it is run by a parent or a child process. We present our prototype called PoLPer which systematically discovers only required setuid system calls and effectively prevents real-world exploits targeting vulnerabilities of the setuid family of system calls in popular desktop and server software at near zero overhead.

Publication Link: https://dl.acm.org/doi/10.1145/3292006.3300028