class: center, middle ### Secure Computer Architecture and Systems *** # Operating Systems: Introduction --- # What is an Operating System? .leftcol[ - A piece of software that **manages hardware and software resources** - Acts as an interface between users and hardware - Examples: Windows, Linux, macOS - Provides a **convenient** and **secure** interface for applications to use the machine ] .rightcol[ <div style="text-align:center"><img src="include/os-layer.svg" width=300 /></div> ] --- # Functions of an Operating System <div style="text-align:center"><img src="include/overview-1.svg" width=800 /></div> --- # Functions of an Operating System <div style="text-align:center"><img src="include/overview-2.svg" width=800 /></div> --- # Functions of an Operating System <div style="text-align:center"><img src="include/overview-3.svg" width=800 /></div> --- # Functions of an Operating System <div style="text-align:center"><img src="include/overview-4.svg" width=800 /></div> --- # Functions of an Operating System <div style="text-align:center"><img src="include/overview-5.svg" width=800 /></div> --- # Functions of an Operating System <div style="text-align:center"><img src="include/overview-6.svg" width=800 /></div> --- # Functions of an Operating System <div style="text-align:center"><img src="include/overview-7.svg" width=800 /></div> --- # Functions of an Operating System <div style="text-align:center"><img src="include/overview-8.svg" width=800 /></div> --- # A Brief History of Operating Systems .leftcol[ - 1950s-60s: ***monitors* (batch systems)** - Jobs submitted as a queue (magnetic tape), run one after the other - Example: IBM IBSYS (for its mainframe computers) - 1960s-70s: **time-sharing systems** - Multiple users/programs share a single computer - Example: Multics, UNIX (inspired many successors) - First security considerations ] .rightcol[ <div style="text-align:center"><img src="include/Pdp-11-40.jpg" width=300 /></div> .center[.small[ PDP-11/40 [Wikipedia](https://en.wikipedia.org/wiki/PDP-11) ] ] ] --- # A Brief History of OSes (2) - 1980s: **personal computers** become popular - Examples: MS-DOS, early Macintosh OS - 1990s–2000s: **GUI-based OSes**: Windows, Linux, macOS - Rise of networking and internet support - Modern era: **mobile OSes** (Android, iOS), **cloud & virtualisation** (VMs, containers) - Security and multi-core support -- - **Embedded/real-time OSes** - Became widespread in the 1980s with the rise of microcontrollers - Specific constraints (e.g. timing deadlines, limited memory and power) - Very relevant today (e.g. IoT) --- # OS Architectures - **Monolithic kernel:** - All OS services packed together in one address space (e.g. Linux) - **Microkernel:** - Minimal kernel (e.g. IPC, scheduling) runs with full privilege; other services such as drivers run deprivileged in separate address spaces (e.g. Minix, QNX, L4) - **Hybrid** monolithic/microkernel (e.g. Windows NT) -- - More exotic/research models: - Multikernel, exokernel, unikernel -- - More on OS architectures and how they impact security in a future lecture --- # OS Kernel vs. Distribution - **Kernel:** - Core part of the OS that manages hardware (CPU, memory, devices) - Examples: Linux kernel, Windows NT kernel, XNU (macOS) -- - **Distribution:** - Kernel + system utilities, libraries, package manager, UI, apps - Examples: Ubuntu (Linux), Fedora (Linux), Debian (Linux) -- .leftlargecol[ <div style="text-align:center"><img src="include/kernel.svg" width=440 /></div> ] .rightsmallcol[ In this course unit, **OS means kernel** ] --- # Security Aspects - **Goals of an OS:** - Provide convenient *resource abstractions* for applications: processes, files, virtual memory, etc. - Share resources efficiently between applications - **Enforce security between applications** (e.g. isolation), which requires correct design and implementation of resource management and scheduling -- - Examples of **security invariants** the OS must maintain: -- - Can't let an app access the address space of another app -- - Can't let an app writing to a file overwrite the disk space of another file -- - Can't let an app hog the CPU at the expense of other apps -- - These matter whether an app misuses OS mechanisms inadvertently (*safety/fault tolerance*) or maliciously (*security/adversarial context*) --- # Security Aspects (2) - A fully **secure operating system** is an ideal goal, arguably an oxymoron - No system of modern complexity is fully secure -- - Security goals generally state which **subjects** (e.g. applications, users) can perform which **operations** (e.g. read, write) on which **objects** (e.g. files, sockets, bytes in memory) - Aim to apply the principle of least privilege and maintain confidentiality, integrity and availability - Often at odds with other OS goals: performance, usability --- # Operating Systems: Trust Models .leftlargecol[ - The **Trusted Computing Base (TCB)** is the set of components enforcing the security goals - The TCB needs to: 1. Mediate all security-sensitive operations 2. Be correct 3. Not be tampered with by software outside the TCB - Depends on the scenario, but the TCB generally includes the **hardware, boot process, all OS code, and some privileged apps** - Can be hard to define precisely, and formally proving its correctness is generally impractical ] .rightsmallcol[ <div style="text-align:center"><img src="include/tcb.svg" width=280 /></div> ] --- # Threat Models - A **threat model** defines what an attacker is assumed to be able to do - Threat models heavily depend on the scenario considered -- - A few examples: - Remote attacker sending malformed network packets - Local user running a malicious application to escalate privileges (e.g. to root) - Malicious or faulty device compromising the driver/OS code - Compromised boot process loading malicious kernel components (e.g. a rootkit) - Attacker accessing kernel logs to leak sensitive information (e.g. to defeat defences such as ASLR) or to erase traces of an intrusion - Etc. --- # Summary - **The OS manages the hardware directly and lets applications use it through a convenient and (hopefully) secure interface** - Provides services such as running and scheduling programs, memory management, file systems, networking, other I/O management, etc. -- - **OS security is a cornerstone of a computer system's security**, but: - Wide variety of threats - The TCB is generally large, hard to define precisely, and very hard to formally verify - TCB components are assumed to work correctly... - ... but OSes are programs, generally written in memory-unsafe languages (e.g. C), and as we have seen they contain vulnerabilities