Reducing TCB of Linux Kernel Using User-Space Device Driver

  • Weizhong QiangEmail author
  • Kang Zhang
  • Hai Jin
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 10048)


The Linux kernel has enormous code size, which makes it a prime target exploited by attackers to steal the privacy of the system, or even to crash the system. Especially, the untrusted Linux device drivers, which take the largest code size of kernel, bring great threats to the kernel. However, current research that tries to isolate the Linux device drivers, either has a large attack surface due to the complex features exposed to applications, or leaves the device drivers in the TCB (Trusted Computing Base). We move the device drivers into user-space to reduce the TCB of kernel, and alter the OS features as libraries to decrease kernel’s attack surface. This paper presents an architecture based on proxy driver and library OSes to separate untrusted and unmodified device drivers from kernels enhanced with a narrower system call interface. We discuss the implementation of a prototype, and also the case study about an unmodified Ethernet card driver supported by the prototype. The evaluation of the case study shows an acceptable performance overhead. We manage to narrow the attack surface by reducing 81.6% of the system calls, and reduce the TCB by decreasing the code base (inside TCB) of the Ethernet card driver into 900 LoC.


Secure kernel Trusted computing base Library operating system User-space device driver 


  1. 1.
    Linux Kernel Security Vulnerabilities.
  2. 2.
    Tsai, C.C., Arora, K.S., Bandi, N., Jain, B., Jannen, W., John, J., Kalodner, H.A., Kulkarni, V., Oliveria, D., Porter, D.E.: Cooperation and security isolation of library OSes for multi-process applications. In: Proceedings of the 9th European Conference on Computer System, pp. 474–495. ACM (2014)Google Scholar
  3. 3.
    Linux kernel i915 driver memory corruption vulnerability.
  4. 4.
    Butti, L., Tinnes, J.: Discovering and exploiting 802.11 wireless driver vulnerabilities. J. Comput. Virol. 4, 25–37 (2008)CrossRefGoogle Scholar
  5. 5.
    Kurmus, A., Tartler, R., Dorneanu, D., Heinloth, B., Rothberg, V.: Attack surface metrics and automated compile-time OS kernel tailoring. In: Proceedings of the 20th Network and Distributed System Security Symposium, pp. 1–18 (2013)Google Scholar
  6. 6.
    Porter, D.E., Boyd-Wickizer, S., Howell, J., Olinsky, R., Hunt, G.C.: Rethinking the library OS from the top down. In: Proceedings of the 6th International Conference on Architectural Support for Programming Languages and Operating System, pp. 291–304. ACM (2011)Google Scholar
  7. 7.
    Kurmus, A., Dechard, S., Kapitza, R.: Quantifiable run-time kernel attack surface reduction. In: Dietrich, S. (ed.) DIMVA 2016. LNCS, vol. 8550, pp. 212–234. Springer, Heidelberg (2014)Google Scholar
  8. 8.
    McCune, J.M., Parno, B.J., Perrig, A., Reiter, M.K., Isozaki, H.: Flicker: an execution infrastructure for TCB minimization. In: Proceedings of the 3rd ACM SIGOPS/EuroSys European Conference on Computer Systems, pp. 315–328. ACM (2008)Google Scholar
  9. 9.
    McCune, J.M., Li, Y., Qu, N., Zhou, Z., Datta, A., Gligor, V., Perrig, A.: Trustvisor: efficient TCB reduction and attestation. In: Proceedings of the 2010 IEEE Symposium on Security and Privacy, SP 2010, pp. 315–328. ACM (2010)Google Scholar
  10. 10.
    Zhou, Z., Yu, M., Gligor, V.D.: Dancing with giants: wimpy kernels for on-demand isolated I/O. In: Proceedings of the 2014 IEEE Symposium on Security and Privacy, SP 2014, pp. 38–46. IEEE (2014)Google Scholar
  11. 11.
    Herder, J.N., Bos, H., Gras, B., Homburg, P., Tanenbaum, A.S.: Fast byte-granularity software fault isolation. In: Proceedings of the 2009 IEEE Dependable Systems and Networks Conference, pp. 45–58. IEEE (2009)Google Scholar
  12. 12.
    Chubb, P.: Linux kernel infrastructure for user-level device drivers. In: Proceedings of the Workshop on Object Systems and Software Architectures (2004)Google Scholar
  13. 13.
    Boyd-Wickizer, S., Zeldovich, N.: Tolerating malicious device drivers in Linux. In: Proceedings of the 2010 USENIX Annual Technical Conference, USENIX Association, pp. 11–20 (2010)Google Scholar
  14. 14.
    Dike, J.: User mode Linux. In: Proceedings of the 5th Annual Linux Showcase and Conference, pp. 3–14. ACM (2001)Google Scholar
  15. 15.
  16. 16.
    MvVoy, L., Staelin, C.: lmbench: portable tools for performance analysis. In: Proceedings of the 1996 USENIX Annual Technical Conference, USENIX Association, pp. 279–294 (1996)Google Scholar
  17. 17.
    Jones, R.: Netperf: A network performance benchmark. version 2.45.
  18. 18.
    Bershad, B.N., Savage, S., Pardyak, P., Sirer, E.G., Fiuzynski, M.E., Becker, D., Chambers, C., Eggers, S.: Extensibility safety and performance in the spin operating system. In: Proceedings of the 15th ACM Symposium on Operating Systems Principles, pp. 267–283. ACM (1995)Google Scholar
  19. 19.
    Liedtke, J.: On micro-kernel construction. In: Proceedings of the 15th ACM Symposium on Operating Systems Principles, SOSP 1995, pp. 237–250. ACM (1995)Google Scholar
  20. 20.
    Dautenhahn, N., Kasampalis, T., Dietz, W., Criswell, J., Adve, V.: Nested kernel: an operating system architecture for intra-kernel privilege separation. In: Proceedings of the Twentieth International Conference on Architectural Support for Programming Languages and Operating Systems, pp. 191–206. ACM (2015)Google Scholar
  21. 21.
    Swift, M.M., Bershad Brian, N., Levy, H.N.: Improving the reliability of commodity operating systems. In: Proccedings of the 19th ACM Symposium on Operating systems Principles, pp. 207–222. ACM (2003)Google Scholar

Copyright information

© Springer International Publishing AG 2016

Authors and Affiliations

  1. 1.Services Computing Technology and System Lab, Cluster and Grid Computing Lab, Big Data Technology and System Lab School of Computer Science and TechnologyHuazhong University of Science and TechnologyWuhanChina

Personalised recommendations