System for accessing a kernel space of an operating system with access control functionality

Patent metadata

Field	Value
Publication number	US-10824745-B2
Application number	US-201715491232-A
Country	US
Kind code	B2
Filing date	Apr 19, 2017
Priority date	Apr 19, 2017
Publication date	Nov 3, 2020
Grant date	Nov 3, 2020

Abstract

In an operating system with access control functionality, a request for a function that requires kernel space access can be initiated by an application and executed in the kernel space using a management mechanism having access to the kernel space. An application container within which the application executes includes a signaling mechanism permitted to access a message bus external to the application container using an access control policy of the operating system. The signaling mechanism signals that a message associated with the request is to be processed with kernel space access. An access control policy of the operating system permits the signaling mechanism to access a message bus used to transmit the message to the management mechanism. The management mechanism executes the function in the kernel space responsive to receiving the message from the message bus and determining that the function requires kernel space access.

First claim

What is claimed is:

1. A system for accessing a kernel space of an operating system with access control functionality, the system comprising:
a memory; and
a processor,
wherein the memory includes instructions executable by the processor to cause the processor to:
receive, via a signaling mechanism within an application container, a request from an application for a function that requires access to the kernel space, wherein the application operates within the application container, wherein the application is configured to be executed within a user space of the operating system outside of the kernel space, wherein the user space is outside of the kernel space so as to protect processes executed in the kernel space from being exploited by processes executed in the user space, and wherein an access control policy of the operating system is configured to control access to the kernel;
transmit, via a message bus, a message associated with the request from the signaling mechanism to a management mechanism outside of the application container, wherein access to the message bus is permitted by the access control policy, and wherein the management mechanism has access to the kernel space;
in response to transmitting the message to the management mechanism, determine that the function corresponding to the request is permitted to access the kernel space, wherein the determination is made outside the kernel space; and
in response to determining that the function is permitted to access the kernel space, transmit the request to the kernel space for execution via the management mechanism.

2. The system of claim 1 , wherein the memory includes instructions executable by the processor to cause the processor to:
determine whether an application programming interface of the management mechanism is configured to handle the request; and
in response to determining that the application programming interface of the management mechanism is configured to handle the request, transmit the request via the message bus.

3. The system of claim 1 , wherein the memory includes instructions executable by the processor to cause the processor to:
execute the function in the kernel space via the management mechanism.

4. The system of claim 1 , wherein the access control policy defines one or more security contexts that permit the signaling mechanism to access the message bus and prevent other applications in the application container from accessing the kernel space, and wherein the one or more security contexts correspond to a property of the request transmitted from the application, such that when the request is associated with the property, the request is exempted from the access control policy.

5. The system of claim 4 , wherein an additional signaling mechanism corresponding to an additional application receives an additional request from the additional application, and wherein the additional signal mechanism determines not to transmit an additional message in response to receiving the additional request to the management mechanism based on the access control policy not including a respective security context of the one or more security contexts that corresponds to the additional request.

6. The system of claim 1 , wherein the message includes parameters associated with the function.

7. The system of claim 1 , wherein the access control functionality is a mandatory access control functionality implemented using Security-Enhanced Linux.

8. The system of claim 1 , wherein a client generates a command from a shell operating on the client, and wherein the application initiates the request based at least in part on the command.

9. A method for accessing a kernel space of an operating system with access control functionality, the method comprising:
receiving, via a signaling mechanism within an application container, a request from an application for a function that requires access to the kernel space, wherein the application operates within the application container, wherein the application is configured to be executed within a user space of the operating system outside of the kernel space, wherein the user space is outside of the kernel space so as to protect processes executed in the kernel space from being exploited by processes executed in the user space, and wherein an access control policy of the operating system is configured to control access to the kernel space;
transmitting, via a message bus, a message associated with the request from the signaling mechanism to a management mechanism outside of the application container using, wherein access to the message bus is permitted by the access control policy, and wherein the management mechanism has access to the kernel space;
in response to transmitting the message to the management mechanism, determining that the function corresponding to the request is permitted to access the kernel space, wherein the determination is made outside the kernel space; and
in response to determining that the function is permitted to access the kernel space, transmitting the request in a transmittable form to the kernel space for execution via the management mechanism.

10. The method of claim 9 , wherein the message is transmitted by the signaling mechanism to the management mechanism responsive to a determination that the request can be handled by a function of an application programming interface of the management mechanism.

11. The method of claim 10 , wherein determining that the function is permitted to access to the kernel space comprises:
executing the function in the kernel space via the management mechanism.

12. The method of claim 9 , wherein the operating system executes on a server having a first network interface, and wherein the method comprises:
receiving, at the first network interface, a command for the function from a shell executing on a client, the client having a second network interface in communication with the first network interface, wherein the request is based on the command.

13. The method of claim 9 , wherein the access control policy defines one or more security contexts that permit the signaling mechanism to access the message bus and prevent other applications in the application container from accessing the kernel space.

14. The method of claim 9 , comprising:
receiving an additional request from an additional application within an additional application container separate from the application container; and
transmitting an additional message generated in response to the additional request to the management mechanism using the message bus, wherein the transmission occurs based at least in part on the access control policy.

15. The method of claim 9 , wherein the message includes parameters associated with the function.

16. The method of claim 9 , wherein the access control functionality is a mandatory access control functionality implemented using Security-Enhanced Linux.

17. A non-transitory computer-readable storage medium, comprising processor-executable routines that, when executed by a processor, cause the processor to perform operations comprising:
receiving, via a signaling mechanism within an application container, a request for a function that requires access to a kernel space of an operating system from an application executing within the application container, wherein the application is configured to be executed within a user space of the operating system outside of the kernel space, wherein the user space is outside of the kernel space so as to protect processes executed in the kernel space from being exploited by processe

Assignees

• Servicenow Inc

Inventors

• Norris Jeremy

Classifications

• G06F9/545 Primary

  where tasks reside in different layers, e.g. user- and kernel-space · CPC title

• G06F21/53

  by executing in a restricted environment, e.g. sandbox or secure virtual machine · CPC title

• G06F13/36

  for access to common bus or bus system · CPC title

• G06F21/62 Primary

  Protecting access to data via a platform, e.g. using keys or access control rules · CPC title