Intra-Process Memory Protection for Applications on ARM and X86 - Leveraging the ELF ABI

Explore intra-process memory protection techniques for ARM and x86 architectures using the ELF ABI. Delve into the challenges of isolating components within a process and learn about ELFbac, a system that leverages the Linux ELF ABI to express and enforce access control policies between program components. Discover how this approach requires no changes to the GNU build chain and operates at the level of ELF object file sections. Examine prototypes for ARM and x86, including practical applications in protecting a validating proxy firewall for DNP3 and implementing a basic policy for Nginx. Gain insights into the implementation details, performance considerations, and potential impact on software security through demonstrations and in-depth explanations of the ELFbac system.

Intro
buggy software
missing software
prototype
Outline
Background
What Matters
Composition
Code Sections
ELF File
UDF
QMail
Isolation Worked
Types
Loaders
Small model example
OpenSSH
OpenSSH Policy
Demo
Policies
SSH
SCADA
Parser
GrSec PACS
Deep Dive
Program Sections
Linker
Task struct
VM struct
OB tree
Page tables
Caches enforce policies
Other layers
Page fault
Data model
Page Faults
Task Structures
Performance Overheads
ELF Backer
ELF ABI Differences
Page Handler Modifications
enforceable contracts
the takeaway
Questions