Computer Science Department
School of Computer Science, Carnegie Mellon University
Privtrans: Automatically Partitioning
Programs for Privilege Separation
David Brumley, Dawn Song
Keywords: Automatic privilege separation, partition program,
automatic program partitioning
Privilege separation partitions a single program into two parts:
a privileged program called the monitor and an unprivileged program
called the slave. All trust and privileges are relegated to the
monitor, which results in a smaller and more secure trust base.
Previously the privilege separation procedure, i.e., partitioning
one program into the monitor and slave, was done by hand. We design
techniques and develop a tool called Privtrans that allows us to
automatically add privilege separation to source code, provided a
few programmer annotations. Additionally, we propose optimization
techniques that augment static analysis with dynamic information.
Our optimization techniques reduce the number of expensive calls
made by the slave to the monitor. We show Privtrans is effective
by integrating privilege separation into several open-source applications.