Reducing TCB of Linux Kernel Using User-Space Device Driver

Abstract

The Linux kernel has enormous code size, which makes it a prime target exploited by attackers to steal the privacy of the system, or even to crash the system. Especially, the untrusted Linux device drivers, which take the largest code size of kernel, bring great threats to the kernel. However, current research that tries to isolate the Linux device drivers, either has a large attack surface due to the complex features exposed to applications, or leaves the device drivers in the TCB (Trusted Computing Base). We move the device drivers into user-space to reduce the TCB of kernel, and alter the OS features as libraries to decrease kernel’s attack surface. This paper presents an architecture based on proxy driver and library OSes to separate untrusted and unmodified device drivers from kernels enhanced with a narrower system call interface. We discuss the implementation of a prototype, and also the case study about an unmodified Ethernet card driver supported by the prototype. The evaluation of the case study shows an acceptable performance overhead. We manage to narrow the attack surface by reducing 81.6% of the system calls, and reduce the TCB by decreasing the code base (inside TCB) of the Ethernet card driver into 900 LoC.