Speaker
Description
Drivers in Linux run with full kernel privileges and account for a significant share of exploitable vulnerabilities. Kage is an experimental kernel subsystem that runs kernel modules inside of in-kernel sandboxes using LLVM's Lightweight Fault Isolation (LFI) feature. Kaged drivers still run in the same hardware privilege level and address space as the rest of the kernel, but are compiled such that control-flow and memory accesses are confined to a subset of virtual memory. This keeps transition costs cheap and reduces the engineering effort needed to retrofit isolation onto existing drivers. LFI is designed to provide secure isolation even for arbitrarily malicious code through the use of a machine code verifier that keeps the compiler out of the trusted code base.
This talk will walk through a prototype version of Kage, which can load LFI-built kernel modules into an isolated portion of the address space, and demonstrate how drivers can be ported to run in sandboxes. Kage uses BTF type information to automatically check call signatures and replace kernel pointers with opaque handles on calls between the kernel and the module. The current prototype can sandbox simple computational kernel modules, and is expected to grow in capabilities in order to handle MMIO, buffer sharing, DMA (via the IOMMU), and interrupt routing, with the end goal of being able to isolate real, complex drivers, such as USB, network, or possibly even GPU drivers.