TR-10-10: A Control Point for Reducing Root Abuse of File-System Privileges

Abstract

We address the problem of restricting root’s ability to change arbitrary files on disk, in order to prevent abuse on most current desktop operating systems. The approach first involves recognizing and separating out the ability to configure a system from the ability to use the system to perform tasks. The permission to modify configuration of the system is then further subdivided in order to restrict applications from modifying the file-system objects of other applications. We explore the division of root’s current ability to change arbitrary files on disk and discuss a prototype that proves out the viability of the approach. Our architecture exposes a control point available for use to enforce policies that prevent one application from modifying another’s file-system objects.

TR-10-10.pdf