Efficient memory compartmentalization scales UNIX processes beyond current limits
Efficient Linkage-Based Compartmentalization on CHERI
Cryptography and SecurityHardware ArchitectureOperating Systems
Summary
Programs often need to keep different parts separate for security and stability, but existing methods limit how many separated parts they can have. The authors present a technique using CHERI hardware that lets software isolate tens of thousands of compartments within a single program, far more than before. This works automatically on existing libraries with minor code changes in rare cases. Their approach also helps programmers debug and manage these isolated parts more easily, supported by multiple modern processors.
What this means in practice
- •For operating system developers: Implement fine-grained in-process isolation that scales to thousands of compartments, improving security and fault containment in large UNIX applications.
- •For browser engineers: Use the model to isolate browser components like Chromium with hundreds of compartments per process for better security boundaries without heavy code rewrites.
Authors
Dapeng Gao, John Baldwin, Jessica Clarke, Nicholas C. Connolly, Brooks Davis, Franz A. Fuchs, Alfredo Mazzinghi, Daniel Moghimi, Peter Rugg, Domagoj Stolfa, Konrad Witaszczyk, Simon W. Moore, Robert N. M. Watson
Abstract
We present an efficient linkage-based model for in-process compartmentalization built on CHERI memory safety, which enables fine-grained compartmentalization of the entire UNIX user-space, scaling to 10K+ compartments on desktop systems. The model's "push-button" compartmentalization along existing library boundaries regularly hosts 500+ compartments per process for large applications such as Chromium, far exceeding the number of concurrently available protection domains supported by other mechanisms (e.g., up to 16 for Intel MPK). Custom policies can further subdivide libraries. Of the thousands of C/C++ programs tested, only the V8 JavaScript engine required source-level adaptation (<300 lines of changed code concerning garbage collection and JIT compilation). We implement the model for CHERI-extended versions of Armv8-A and RISC-V through support in the compiler toolchain and operating system. Case studies illustrate the smooth delegation of memory between compartments, compartment-aware debugging and visualization, as well as extensibility to a complex managed language runtime, demonstrating the benefits of our single-address-space model. We evaluate using multiple processors, including Arm's superscalar Morello and, notably, the first commercial CHERI-enabled RISC-V application core---Codasip's in-order dual-issue X730.