Master thesis : Integrating address space layout randomization and make it compatible with memory de-duplication in Unikraft

Abstract

During the past years, people's online services usage kept growing which increases the load on the servers of cloud services and content distribution network. Those servers often run on containers that run on top of monolithic operating systems or simply on monolithic operating systems which embarks libraries, abstractions and codes that may nor be needed nor be used by the application it runs.

Unikernels give the opportunity to the developer to build a specific operating system that contains only features that will be further used by the application and run it directly on top of the hypervisor. Furthermore, simplifying the operating system, on which the application runs, often results in a performance gain.

However, if unikernels were to be used more frequently by the industry, we have to be certain that they are as secure as the other technologies available on the market. Throughout this thesis, we have implemented address space layout randomization inside Unikraft in order to make memory related vulnerabilities harder to exploit.

Nevertheless, address space layout randomization comes at a cost which is its memory usage. We addressed that problem and found a way to mitigate the overhead : through page sharing between the unikernels thanks to indirection tables, which were implemented in two different manners. In the first, problematic instructions were set in a table that is appended directly to its corresponding library while the second creates a global table at a specified address that holds instructions from every libraries. Gaulthier Gain, the co-supervisor of this thesis, implemented the appended method thus this thesis addresses the implementation of the global table and the comparison between the two manners.

Finally, we compared the performances of our address space layout randomization with Unikraft's previous implementation of it, and we discussed the two indirection methods. We came to the conclusion that the appended tables gave satisfying results when there was enough images running on the hypervisor, while the other was not giving any memory savings due to the constraints induced by the x86 64 bits CPU architecture.