Lightweight Capability Domains: Decomposing the Linux Kernel

Even after decades of work to make monolithic kernels more secure, serious vulnerabilities in them are still reported every year. Because the entire monolithic kernel is in one address space, an attacker is just one vulnerability away from owning the entire machine. We argue that it is time to decompose monolithic kernels like Linux into smaller parts that run in isolated compartments and communicate using secure interfaces. We think this is timely due to recent trends in hardware that make it easier and efficient to isolate kernel components. In this work, we describe our initial steps toward this goal. We implemented a small microkernel module that is installed in Linux and manages Lightweight Capability Domains (LCDs) that are implemented using hardware virtual machines. We describe our implementation and the challenges we encountered in attempting to run unmodified kernel code in isolation.