Network I/O Extensibility without Administrator Privilege

Abstract

Kernel extension mechanisms for network I/O are very useful for creating customized packet processing. However, such extensions have been accessible only to system administrators for security reasons. This paper investigates an approach to realize network I/O extensibility without administrator privilege. To this end, we build on a novel virtualization scheme developed for network control, hierarchical virtualization of network interfaces, which allows recursive creation of the virtualized network interfaces and attaches the created interfaces to OS entities, such as sockets and processes. We show that the hierarchical virtualization has desirable properties for safe execution of packet processing code inside OS kernels, even by ordinary users and untrusted applications. For proof-of-concept, functionality of the system is demonstrated by a prototype implementation and execution profiling is taken to verify if such a kernel extensibility can be realized at practical performance overhead. The systematic experiments illustrated that the hierarchical virtualization can realize kernel extensibility without administrator privilege.