Appel système

Résumé

En informatique, un appel système (c'est-à-dire appel au système [d'exploitation]) (en anglais, system call, abrégé en syscall) désigne le moment où un programme s'interrompt pour demander au système d'exploitation d'accomplir pour lui une certaine tâche. L'expression désigne donc aussi la fonction primitive elle-même fournie par le noyau d'un système d'exploitation. Sont ainsi contrôlées et uniformisées les applications de l'espace utilisateur ; certains droits d'accès peuvent de plus être réservés au noyau. Le noyau lui-même utilise ces fonctions, qui deviennent la seule porte entre un programme et le « monde extérieur ». Le rôle du noyau est de gérer les ressources matérielles (il contient des pilotes de périphériques) et de fournir aux programmes une interface uniforme pour l'accès à ces ressources. Dans cette configuration, par exemple, toutes les instructions de lecture ou d'écriture sur un média externe doivent passer par le noyau, qui les passe au pilote, lequel les passe au

Source officielle

https://fr.wikipedia.org/wiki/Appel_syst%C3%A8me

À propos de ce résultat

Cette page est générée automatiquement et peut contenir des informations qui ne sont pas correctes, complètes, à jour ou pertinentes par rapport à votre recherche. Il en va de même pour toutes les autres pages de ce site. Veillez à vérifier les informations auprès des sources officielles de l'EPFL.

Publications associées (7)

Publications associées

Chargement

Personnes associées

Chargement

Unités associées

Chargement

Concepts associés (65)

Concepts associés

Chargement

Cours associés (11)

Introduction to basic concepts of operating systems.

This course focuses on software security fundamentals, secure coding guidelines and principles, and advanced software security concepts. Students learn to assess and understand threats, learn how to design and implement secure software systems, and get hands-on experience with security pitfalls.

The students will acquire a solid knowledge on the processes necessary to design, write and use scientific software. Software design techniques will be used to program a multi-usage particles code, aiming at providing the link between algorithmic/complexity, optimization and program designs.

Afficher plus

Cours associés

Chargement

Séances de cours associées (25)

Séances de cours associées

Chargement

Preventing Use-After-Free Attacks with Fast Forward Allocation

Sanidhya Kashyap, Jungwon Lim

Memory-unsafe languages are widely used to implement critical systems like kernels and browsers, leading to thousands of memory safety issues every year. A use-after-free bug is a temporal memory error where the program accidentally visits a freed memory location. Recent studies show that use-after-free is one of the most exploited memory vulnerabilities. Unfortunately, previous efforts to mitigate use-after-free bugs are not widely deployed in real-world programs due to either inadequate accuracy or high performance overhead. In this paper, we propose to resurrect the idea of one-time allocation (OTA) and provide a practical implementation with efficient execution and moderate memory overhead. With one-time allocation, the memory manager always returns a distinct memory address for each request. Since memory locations are not reused, attackers cannot reclaim freed objects, and thus cannot exploit use-after-free bugs. We utilize two techniques to render OTA practical: batch page management and the fusion of bump-pointer and fixed-size bins memory allocation styles. Batch page management helps reduce the number of system calls which negatively impact performance, while blending the two allocation methods mitigates the memory overhead and fragmentation issues. We implemented a prototype, called FFmalloc, to demonstrate our techniques. We evaluated FFmalloc on widely used benchmarks and real-world large programs. FFmalloc successfully blocked all tested use-after-free attacks while introducing moderate overhead. The results show that OTA can be a strong and practical solution to thwart use-after-free threats.

USENIX ASSOC2021

Chargement

PoLPer: Process-Aware Restriction of Over-Privileged Setuid Calls in Legacy Applications

Mathias Josef Payer, Zhenyu Wu

setuid system calls enable critical functions such as user authentications and modular privileged components. Such operations must only be executed after careful validation. However, current systems do not perform rigorous checks, allowing exploitation of privileges through memory corruption vulnerabilities in privileged programs. As a solution, understanding which setuid system calls can be invoked in what context of a process allows precise enforcement of least privileges. We propose a novel comprehensive method to systematically extract and enforce least privilege of setuid system calls to prevent misuse. Our approach learns the required process contexts of setuid system calls along multiple dimensions: process hierarchy, call stack, and parameter in a process-aware way. Every setuid system call is then restricted to the per-process context by our kernel-level context enforcer. Previous approaches without process-awareness are too coarse-grained to control setuid system calls, resulting in over-privilege. Our method reduces available privileges even for identical code depending on whether it is run by a parent or a child process. We present our prototype called PoLPer which systematically discovers only required setuid system calls and effectively prevents real-world exploits targeting vulnerabilities of the setuid family of system calls in popular desktop and server software at near zero overhead.

ASSOC COMPUTING MACHINERY2019

Chargement

Networked Systems: Introducing Network Management Models into ODP

Jean-Pierre Hubaux

The complexity of networked systems calls for their management. The ODP framework based on viewpoints provides powerful concepts to support the specification and design of distributed systems, but without fully considering their management. In order for ODP to avoid re-inventing the wheel with regard to management, the results of network management standards that we have structured in terms of models should be integrated in the ODP framework. Therefore, this paper defines the mapping between the network management models and the ODP viewpoints. Emphasis lies on the realization of a connection management function using the proposed method.

1995

Chargement