Operating System Protection for Fine-Grained Programs

We present an operating system-level security model for controlling ne-grained programs, such asdownloaded executable content, and compare this security model's implementation to that of language-based security models. Language-based security has wellknown limitations, such as the lack of complete mediation (e.g., for compiled programs or race condition attacks) and faulty self-protection (e ective security is unproven). Operating system-level models are capable of complete mediation and self-protection, but some researchers argue that operating systemlevel security models are unlikely to supplant such language-based models because they lack portability and performance. In this paper, we detailanoperating system-level security model built on the Lava Nucleus, a minimal, fast-kernel operating system. We show how it can enforce security requirements for ne-grained programs and show that its performance overhead (with the additional security) can be virtually negligible when compared to languagebased models. Given the su cient performance and security, the portability issue should become moot because other vendors will have to meet the higher security and performance expectations of their customers.