From 3da5bc345890629cab65b4e2d2d1fc2c7be0829e Mon Sep 17 00:00:00 2001
From: Holger Dengler <dengler@linutronix.de>
Date: Thu, 4 Aug 2016 17:12:02 +0200
Subject: sec: Update Process isolation slides

Signed-off-by: Holger Dengler <dengler@linutronix.de>
---
 security/advanced/frm_process_thread.tex | 293 ++++++++++++++++++++++++++++---
 1 file changed, 271 insertions(+), 22 deletions(-)

(limited to 'security/advanced/frm_process_thread.tex')

diff --git a/security/advanced/frm_process_thread.tex b/security/advanced/frm_process_thread.tex
index b58a452..ed9bfc3 100644
--- a/security/advanced/frm_process_thread.tex
+++ b/security/advanced/frm_process_thread.tex
@@ -3,7 +3,30 @@
 
 % ----------------------------
 \begin{frame}[fragile]
-\frametitle{Why isolating tasks?}
+\frametitle{Why Process isolation?}
+\begin{itemize}
+\item Embedded Application requires:
+ \begin{itemize}
+ \item concurrency
+ \item data persistence
+ \item access to (critical) HW
+ \item remote interface (field bus, network)
+ \end{itemize}
+\item Problem:
+ \begin{itemize}
+ \item attacks can compromise Application parts, which handle the remote access
+ \item compromised parts influence all other parts
+ \end{itemize}
+\item Solution:
+ \begin{itemize}
+ \item Process isolation
+ \end{itemize}
+\end{itemize}
+\end{frame}
+
+% ----------------------------
+\begin{frame}[fragile]
+\frametitle{Multithreaded Application}
 \begin{figure}[h]
 \centering
 \includegraphics[width=5cm]{images/multithread_norm.png}
@@ -21,7 +44,50 @@
 
 % ----------------------------
 \begin{frame}[fragile]
-\frametitle{Multi-process vs. Multi-thread}
+\frametitle{Threads and Processes}
+\begin{itemize}
+\item Process
+ \begin{itemize}
+ \item one Virtual Address Space (VAS) per Process
+ \item 1..n Threads
+ \end{itemize}
+\item Thread
+ \begin{itemize}
+ \item separate schedulable entity
+ \item concurrent execution
+ \end{itemize}
+\item all Threads of a Process share the same VAS!
+\end{itemize}
+\end{frame}
+
+% ----------------------------
+\begin{frame}[fragile]
+\frametitle{Multiprocess vs. Multithread}
+\begin{itemize}
+\item Problem: if one Thread has been compromised \dots
+ \begin{itemize}
+ \item all other Threads of the Process are affected
+ \item malicious code has full access to VAS
+ \end{itemize}
+\item Solution Statement
+ \begin{enumerate}
+ \item define critical and non-critical tasks in Application
+ \item define a communication channel between both parts
+ \item isolate critical and non-critical tasks in separate Processes
+ \end{enumerate}
+\item Result
+ \begin{itemize}
+ \item compromised tasks can not directly access other parts
+ \item isolate malware/exploits from critical Application parts
+ \item opt: Plausibility check on communication channel
+ \end{itemize}
+\item \textbf{Process isolation is the base for ALL further security actions!}
+\end{itemize}
+\end{frame}
+
+% ----------------------------
+\begin{frame}[fragile]
+\frametitle{Multiprocess Application}
 \begin{figure}[h]
 \centering
 \includegraphics[width=8cm]{images/multiproc_norm.png}
@@ -30,22 +96,35 @@
 
 % ----------------------------
 \begin{frame}[fragile]
-\frametitle{Multi-process under attack}
+\frametitle{Multiprocess Application under attack}
 \begin{figure}[h]
 \centering
 \includegraphics[width=8cm]{images/multiproc_attack.png}
 \end{figure}
 \end{frame}
 
+% ----------------------------
+\begin{frame}[fragile]
+\frametitle{Multiprocess: Summary}
+\begin{itemize}
+\item Thread: separate scheduling/execution
+\item Process: separate scheduling/execution and memory (VAS)
+\item Communication: use Inter-Process-Communication (IPC) to connect Processes
+\item and all together: \\
+      \textbf{Process isolation is the base for ALL further security actions!}
+\end{itemize}
+\end{frame}
+
 % ----------------------------
 \subsubsection{Memory Management}
 
 % ----------------------------
 \begin{frame}[fragile]
-\frametitle{Memory Manangement}
+\frametitle{Memory Management}
 \begin{itemize}
-\item create process context
-\item overload VMA
+\item fork(): create copy of Process context
+\item IPC: communication mechanisms
+\item execve(): overload Process context and execute it
 \end{itemize}
 \begin{figure}[h]
 \centering
@@ -58,34 +137,35 @@
 
 % ----------------------------
 \begin{frame}[fragile]
-\frametitle{Multiprocess Programming}
+\frametitle{Multiprocess Programming: Example}
 \begin{columns}[onlytextwidth]
  \begin{column}{0.45\textwidth}
  \begin{beamerboxesrounded}[shadow=true]{Program:}
- \begin{tiny}
+ \begin{scriptsize}
  \begin{verbatim}
 [...]
-pid = fork();
-switch (pid) {
-case -1:
-        /* error handling */
-case 0:
-        /* child processing */
-        execve(argv[0], &argv[0], envp);
-        break;
-default:
+ret = fork();
+if (ret < 0)
+        /* error handling */;
+
+pid = ret;
+if (pid) {
         /* parent processing */
         [...]
         pid = wait(&status);
+} else {
+        /* child processing */
+        execve(argv[0], &argv[0], envp);
+        break;
 }
 [...]
  \end{verbatim}
- \end{tiny}
+ \end{scriptsize}
  \end{beamerboxesrounded}
  \end{column}
  \begin{column}{0.45\textwidth}
  \begin{beamerboxesrounded}[shadow=true]{Arguments:}
- \begin{tiny}
+ \begin{scriptsize}
  \begin{verbatim}
 char *argv[] = {
         "/bin/myappl",
@@ -94,10 +174,10 @@ char *argv[] = {
         NULL,
 };
  \end{verbatim}
- \end{tiny}
+ \end{scriptsize}
  \end{beamerboxesrounded}
  \begin{beamerboxesrounded}[shadow=true]{Environment:}
- \begin{tiny}
+ \begin{scriptsize}
  \begin{verbatim}
 char *envp[] = {
         "HOME=/myhome",
@@ -106,7 +186,176 @@ char *envp[] = {
         NULL,
 };
  \end{verbatim}
- \end{tiny}
+ \end{scriptsize}
+ \end{beamerboxesrounded}
+ \end{column}
+\end{columns}
+\end{frame}
+
+% ----------------------------
+\begin{frame}[fragile]
+\frametitle{Inter-Process Communication (IPC)}
+\begin{itemize}
+\item Requirements
+ \begin{itemize}
+ \item communicate between Processes (e.g. Child to Parent)
+ \item private communication channel
+ \end{itemize}
+\item Solution Statement
+ \begin{enumerate}
+ \item open an anonymous pipe
+ \item duplicate process with fork()
+ \item Parent and Child choose a communication role
+  \begin{itemize}
+  \item Sender: close the read-FD and send data to write-FD
+  \item Listener: close the write-FD and listen on read-FD
+  \end{itemize}
+ \end{enumerate}
+\item Note:
+ \begin{itemize}
+ \item pipe-syscall opens two file-descriptors \\
+       (one for read from, and one for write to the pipe)
+ \item after fork-syscall, both processes has access to pipe file-descriptors
+ \item pipe communication is unidirectional
+ \end{itemize}
+\item Result
+ \begin{itemize}
+ \item private communication between Parent and Child
+ \item decoupled, buffered communication through pipe
+ \end{itemize}
+\item other IPC mechanisms (e.g. POSIX IPC) are also possible
+\end{itemize}
+\end{frame}
+
+% ----------------------------
+\begin{frame}[fragile]
+\frametitle{IPC: Example with anonymous pipe (child -> parent)}
+\begin{columns}[onlytextwidth]
+ \begin{column}{0.45\textwidth}
+ \begin{beamerboxesrounded}[shadow=true]{Open Pipe before fork():}
+ \begin{scriptsize}
+ \begin{verbatim}
+int fds[2];
+
+/* open pipe file-descriptors */
+ret = pipe(fds);
+if (ret)
+        /* error handling */;
+
+ret = fork();
+if (ret < 0)
+        /* error handling */;
+pid = ret;
+
+/*
+ * Both processes, parent and
+ * child, has now access to the
+ * opened pipe file-descriptors.
+ */
+ \end{verbatim}
+ \end{scriptsize}
+ \end{beamerboxesrounded}
+ \end{column}
+ \begin{column}{0.45\textwidth}
+ \begin{beamerboxesrounded}[shadow=true]{Parent (Listener):}
+ \begin{scriptsize}
+ \begin{verbatim}
+if (pid) {
+        /* close pipe-write-fd */
+        close(fds[1]);
+
+        /* read data from pipe-read-fd */
+        while ((ret = read(fds[0],
+                           &buf,1) > 0))
+                /* handle read data */;
+} else {
+        [...]
+}
+ \end{verbatim}
+ \end{scriptsize}
+ \end{beamerboxesrounded}
+ \begin{beamerboxesrounded}[shadow=true]{Child (Sender):}
+ \begin{scriptsize}
+ \begin{verbatim}
+if (pid) {
+        [...]
+} else {
+        /* close pipe-read-fd */
+        close(fds[0]);
+
+        /* send data to pipe-write-fd */
+        write(fds[1], buf,
+              strnlen(buf, BUF_LEN));
+}
+ \end{verbatim}
+ \end{scriptsize}
+ \end{beamerboxesrounded}
+ \end{column}
+\end{columns}
+\end{frame}
+
+% ----------------------------
+\begin{frame}[fragile]
+\frametitle{IPC: Example with anonymous pipe (parent -> child)}
+\begin{columns}[onlytextwidth]
+ \begin{column}{0.45\textwidth}
+ \begin{beamerboxesrounded}[shadow=true]{Open Pipe before fork():}
+ \begin{scriptsize}
+ \begin{verbatim}
+int fds[2];
+
+/* open pipe file-descriptors */
+ret = pipe(fds);
+if (ret)
+        /* error handling */;
+
+ret = fork();
+if (ret < 0)
+        /* error handling */;
+pid = ret;
+
+/*
+ * Both processes, parent and
+ * child, has now access to the
+ * opened pipe file-descriptors.
+ */
+ \end{verbatim}
+ \end{scriptsize}
+ \end{beamerboxesrounded}
+ \end{column}
+ \begin{column}{0.45\textwidth}
+ \begin{beamerboxesrounded}[shadow=true]{Parent (Sender):}
+ \begin{scriptsize}
+ \begin{verbatim}
+if (pid) {
+        /* close pipe-read-fd */
+        close(fds[0]);
+
+        /* send data to pipe-write-fd */
+        write(fds[1], buf,
+              strnlen(buf, BUF_LEN));
+} else {
+        [...]
+}
+ \end{verbatim}
+ \end{scriptsize}
+ \end{beamerboxesrounded}
+ \begin{beamerboxesrounded}[shadow=true]{Child (Listener):}
+ \begin{scriptsize}
+ \begin{verbatim}
+if (pid) {
+        [...]
+} else {
+        /* close pipe-write-fd */
+        close(fds[1]);
+
+        /* read data from pipe-read-fd */
+        while ((ret = read(fds[0],
+                      &buf, 1) > 0))
+                /* handle read data */;
+}
+ \end{verbatim}
+ \end{scriptsize}
  \end{beamerboxesrounded}
  \end{column}
 \end{columns}
-- 
cgit v1.2.3

