Publication

PoLPer: Process-Aware Restriction of Over-Privileged Setuid Calls in Legacy Applications

Related publications (28)

Graph Chatbot

Chat with Graph Search

Ask any question about EPFL courses, lectures, exercises, research, news, etc. or try the example questions below.

DISCLAIMER: The Graph Chatbot is not programmed to provide explicit or categorical answers to your questions. Rather, it transforms your questions into API requests that are distributed across the various IT services officially administered by EPFL. Its purpose is solely to collect and recommend relevant references to content that you can explore to help you answer your questions.

Computer systems rely heavily on abstraction to manage the exponential growth of complexity across hardware and software. Due to practical considerations of compatibility between components of these complex systems across generations, developers have favou ...

EPFL2024

A RISC-V Extension to Minimize Privileges of Enclave Runtimes

Edouard Bugnion, Neelu Shivprakash Kalani

In confidential computing, the view of the system software is Manichean: the host operating system is untrusted and the TEE runtime system is fully trusted. However, the runtime system is often as complex as a full operating system, and thus is not free fr ...

ACM2023

SecureCells: A Secure Compartmentalized Architecture

Babak Falsafi, Mathias Josef Payer, Yuanlong Li, Florian Hofhammer, Siddharth Gupta, Atri Bhattacharyya, Andrés Sánchez Marín

Modern programs are monolithic, combining code of varied provenance without isolation, all the while running on network-connected devices. A vulnerability in any component may compromise code and data of all other components. Compartmentalization separates ...

2023

Creating Trust by Abolishing Hierarchies

Mathias Josef Payer, Edouard Bugnion, Evangelos Marios Kogias, Adrien Ghosn, Charly Nicolas Lucien Castes, Neelu Shivprakash Kalani, Yuchen Qian

Software is going through a trust crisis. Privileged code is no longer trusted and processes insufficiently protect user code from unverified libraries. While usually treated separately, confidential computing and program compartmentalization are both symp ...

Association for Computing Machinery2023

Exploring brain-inspired multi-core heterogeneous hardware templates for low-power biomedical embedded systems

Benoît Walter Denkinger

The miniaturization of integrated circuits (ICs) and their higher performance and energy efficiency, combined with new machine learning algorithms and applications, have paved the way to intelligent, interconnected edge devices. In the medical domain, they ...

EPFL2023

Midas: Systematic Kernel TOCTTOU Protection

Mathias Josef Payer, Atri Bhattacharyya, Uros Tesic

Double-fetch bugs are a plague across all major operating system kernels. They occur when data is fetched twice across the user/kernel trust boundary while allowing concurrent modification. Such bugs enable an attacker to illegally access memory, cause den ...

2022

, ,

We consider the problem of training a neural network to store a set of patterns with maximal noise robustness. A solution, in terms of optimal weights and state update rules, is derived by training each individual neuron to perform either kernel classifica ...

2022

Writing a correct operating system kernel is notoriously hard. Kernel code requires manual memory management and type-unsafe code and must efficiently handle complex, asynchronous events. In addition, increasing CPU core counts further complicate kernel de ...

USENIX ASSOC2021

Preventing Use-After-Free Attacks with Fast Forward Allocation

Sanidhya Kashyap, Jungwon Lim

Memory-unsafe languages are widely used to implement critical systems like kernels and browsers, leading to thousands of memory safety issues every year. A use-after-free bug is a temporal memory error where the program accidentally visits a freed memory l ...

USENIX ASSOC2021

Advancing the State of Network Switch ASIC Offloading in the Linux Kernel

Andy Roulin

Modern data-center network operating systems rely on proprietary user-space daemons wrapping SDKs from switch vendors. Linux-based variants of these operating systems have benefited from increasing and simplified dataplane offloading support in recent year ...

2018