LeMo: Protecting Kernel with Least Privilege Modules

The Linux kernel is the monolithic kernel, and the boundaries among the objects in the kernel are not particularly clear. Once the malicious module is loaded in the kernel, it can almost access the entire kernel. This breaks the principle of least privilege. To overcome it, in this paper, we propose LeMo which is the novel architecture to hold the module with least privilege in the kernel. In LeMo, the modules are restricted to access the necessary kernel objects. To the end, before the module is loaded in the kernel, the patched kernel build a new page table for the module. With page-based access control, the patched kernel is capable of preventing the malicious modules to arbitrarily access the kernel. We have implemented the prototype of LeMo which provide the tools which load or unload the module. Our evaluation show that LeMo is able to defeat the malicious module with a acceptable performance overhead.