DragonFly kernel List (threaded) for 2013-04
GSOC : Draft proposal for capsicum
(it looks like my first mail did not go to the list because i was not
Sorry if it was sent twice)
I'm a 4th year CS student at Université Diderot Paris 7. I don't really
public open source C code yet, but it's a good time to start ! I've
OS/System class, one on Unix kernel internal, and the other on POSIX
been reading parts of the DragonFly kernel during the laste year, and
hammering code to get familiar with it. I've already started a capscium
but it's still in an early state. I wrote those patches in december, but
them are outdated since FreeBSD reworked the capsicum kernel API since that
(keeping a compatibility layer). HEre is a draft proposal. Since some code
whould be quite pervasive in the kernel, please comment !
Capsicum is a fine grained capability framework for unix systems. It can
to sandbox applications by restructing their access to various global
While DAC and unix rights grant access at the user level, capscium is
to implement security policies at the application or library level.
frameworks (SELinux, AppArmor, ...) where access profile is configured
out of the
code, capsicum sandboxing policy might directly be built in the application
itself. Capscum is currently implemented in the FreeBSD kernel, and some
ongoing on the linux side.
Capsicum extends various POSIX API and add some others. The kernel part
* Capability mode : a process mode, set by a system call, in which
global namespaces is restricted. For instance, system calls like
socket(2) might not be used. The capability mode is inherited by the
processes. Once in capability mode, only the delegated rights may be
* Capabilities : rights can be attached to file descriptors to
Descriptors already have access flags, but nothing prevents you tu
readonly file descriptor to a read-write one. Capabilities can be
a set of system calls.
* Process descriptors : on POSIX systems, you can only manage process by
accessing the PID namespace. To allow parent pids to manage childs
in capability mode, a new API have been created. Like file descriptors,
they are local descriptors for process and can be managed by a set of
syscalls : pdfork, pdkill, pdwait4 and pdgetpid.
* Shared memory : anonymous shared memory has been extended to allow
memory segment to be referenced and accessed by descriptors.
The userspace tools and libraries are still a moving target.
* Applications and livrariies have to be converted to capsicum. Rights
be defined for various critical libraries, and some tools have to be
between a worker process in capability mode and a control process.
* libcapsicum : a library is beeing created to ease the developpement of
* casper is a prototyped daemon which offers various services to
capability mode, like DNS resolution.
The userspace implemnetations are not yet finalized and a lot of them could
be ported from FreeBSD once they are done. This proposal is mostly about
kernel APIs. The goal is to have an implementation of the various syscalls
compatible with the FreeBSD kernel API.
The shared memory extension has already been implemented in dragonfly.
only the first three parts have to be implemented, with the glue needed to
integrate them in the kernel and the build system (for instance, the
mode flag has to be add to the process structure).
I could start coding in June.
- 3 weeks :
Implement capabilities for filedescriptos in kern_descrip.c.
capabilities have to be attached to each filedesc. An Ioctls
needed, which means dynamically alloced space for each
such list. Capabilities are check each time a process gets a file
from a file descriptot.
- 3 weeks :
Capability mode. This include a set of syscall to set/get
capabilities of a
descriptor, fork/rpces integration, and maybe some ktrace
debugging purpose. In this area the code skeleton from freeBSD can
but not "as-is", due to different locking mechanisms.
- 2 weeks :
Add capability checks ti various syscalls : *at(2), nlookup, sysctl.
should be fairly easy, but at this point, I should have a semi-working
capsicum implementation, and it whould be a good time to do some
- Mid-term evaluation
- 3 weeks :
proces descriptor API. Add 4 syscalls pdfiork, pdwait4, pdkill, and
which use file descriptor-like API to reference processes.
- 2 weeks :
Add connectat() and bindat() syscalls for UNIX domain sockets. Their
whould be similar to the *at syscall familly.
- remaining time :
Check the syscalls list, the sysctl and the ioctls list to identify
ones, and to more testing of the whole implementation. If possible,
port some FreeBSD tool which uses capsicum and make it run.
capsicum project page : http://www.cl.cam.ac.uk/research/security/capsicum/
Thanks for reading,