Program confinement in KVM/370

One aspect of producing secure operating systems involves the confinement of programs. This paper discusses the program confinement problem as addressed by the developers of a retrofitted version of the IBM VM/370 virtual machine monitor. This version of the system (called KVM/370) uses a security-kernel architecture to provide a provably secure multi-level environment for Department of Defense computer operations. To produce an efficient system, software and hardware resources must be globally shared among all processes of the security hierarchy. Since not all portions of KVM/370 can be formally proven, it is possible that untrusted software controlling global resources can be used to transmit sensitive information from a high-level to a low-level process. This paper discusses the techniques used in KVM/370 to confine programs (to prevent data leakage) so that the security of the system is preserved. A brief architectural description of the system is presented as well.