Research in OS: Light-weight contexts

Transcription

1 Research in OS: Light-weight contexts Light-weight Contexts: An OS Abstraction for Safety and Performance J. Litton, A. Vahldiek-Oberwagner, E. Elnikety, D. Garg, B. Bhattacharjee, P. Druschel, Proc. of OSDI 2016 *Slides partially based on Litton s presentation

2 (Some) useful concepts picked up in OS Processes, threads, COW, system calls, interrupts, signals, virtual memory, TLB, file descriptors, (In no particular order) 2

3 Processes and forks A process Unit of isolation, privilege separation, and program state attributes memory creds threads Fork, if you need Isolation, privilege separation, and program state But scheduling and coordination overhead files registers attributes threads attributes threads attributes threads process memory creds memory files creds registers memory files creds registers files registers process 3

4 Light-Weight Context Intra-process isolation of system resources Isolation and privilege separation among program components Fast OS-level snapshot Co-routine style control transfer among contexts Process start with a root lwc lwc can create children attributes root lwc memory creds files registers Threads run within lwc and can switch threads child lwc 1 memory creds files registers process 4

5 Creating lwcs root lwc Let s start with a single threaded processes mmap 5

6 lwcreate new, caller, args lwcreate(specs, options) root lwc mmap lwcreate lwc are named using file descriptors Create s default semantic ~fork: child is identical copy of parent child lwc 1 No new thread is created Multiple threads? All should be in a consistent state when calling create use a barrier for this When first switching, lwcreate returns with arguments The child is a copy (via COW) of the parent 6

7 lwswitch new, caller, args lwcreate(specs, options) root lwc mmap lwcreate child lwc 1 With resource-spec, parent can restrict what s being shared, and how (e.g., shared or copied) The child may share, get a copy or omit parent resources 7

8 lwcreate caller, args lwswitch(target, args) root lwc lwcreate lwswitch child lwc 1 Switch to target, passing arguments; when switching back, call returns with the switching lwc as caller and arguments in args lwswitch lwswitch lwswitch provides coroutine semantics 8

9 API Summary Create lwc new, caller, args lwcreate(spec,options) Switch to lwc caller, args lwswitch(target,args) Resource Access status lwrestrict(lwc,spec) status lwoverlay(lwc,spec) status lwsyscall(target,mask,syscall, args) 9

10 Resource sharing and capabilities Static sharing Parent can restrict what s shared subsets of file descriptors virtual memory credentials and how, LWC_COW copy LWC_SHARED shared LWC_UNMAP not mapped Dynamic sharing A lwc may dynamically map resources from another lwc (lwoverlay) if it holds the access capabilities Parents can restrict capabilities lwrestrict Typical use, root runs a high-assurance component and exports narrow interface to children 10

11 System calls and signal handling System call interposition A lwc C, created with LWC_SYSTRAP flag If thread in C makes a syscall, switches to parent Argument in switch have syscall # tried, args passed to it Parent can run it on the child s behalf and return with results Authorized lwc can make syscalls on behalf of a target lwc with lwsyscall As if the target had done the syscall, but caller can specify aspects of its own context to make available during the call (e.g., use my credentials instead) Signal handling Attributable signals (to an instruction) delivered to the lwc (e.g., SIGSEGV), others to root (e.g., SIGKILL) 11

12 Common uses Session isolation Sensitive data isolation Snapshot and rollback E.g., aervice process initializes its state to the point where it can server requests, snapshots that, serves a request and rolls back before serving another (more efficient and less risky than cleaning after) Reference monitoring Intercept and monitor any subset of syscalls made by a child 12

13 Common usage patterns Snapshots active lwc lwcreate snapshot 13

14 Common usage patterns Snapshots active lwc lwcreate snapshot lwswitch close snapshot lwcreate 14

15 Reference Monitor monitor lwcreate application lwswitch sandbox lwsyscall syscall lwswitch 15

16 Evaluation Implemented in FreeBSD 11.0 Microbenchmarks lwcreate lwswitch Reference monitoring (systrap) Apache (v ) Session isolation Reference monitoring Nginx (v ) Session isolation Reference monitoring SSL private key isolation PHP (v ) Fast startup via snapshots 16

17 Creation/Destruction Cost No pages dirtied 87.7 microseconds Additional COW cost per page dirtied ~ 3.4 microseconds 17

18 Switching Cost 18

19 Evaluation - nginx High performance web server Asynchronous & event-driven No session isolation nginx To enable session isolation one lwc for each new connection Also integrated a reference monitor lwc-event lwc-event-mon 19

20 Evaluation - nginx 20

21 Evaluation - nginx 21

22 Evaluation - nginx 22

23 Summary Light-weight Contexts a new OS abstraction Provides Units of isolation, privilege and execution state independence within a process Fast OS-level snapshots Co-routine style control transfer between contexts Source code, evaluation framework, 23