Repository logo

Infoscience

  • English
  • French
Log In
Logo EPFL, École polytechnique fédérale de Lausanne

Infoscience

  • English
  • French
Log In
  1. Home
  2. Academic and Research Output
  3. Journal articles
  4. Gradient: Gradual Compartmentalization via Object Capabilities Tracked in Types
 
research article

Gradient: Gradual Compartmentalization via Object Capabilities Tracked in Types

Boruch-Gruszecki, Aleksander
•
Ghosn, Adrien
•
Payer, Mathias  
Show more
October 1, 2024
Proceedings Of The ACM On Programming Languages-pacmpl

Modern software needs fine-grained compartmentalization, i.e., intra-process isolation. A particularly important reason for it are supply-chain attacks, the need for which is aggravated by modern applications depending on hundreds or even thousands of libraries. Object capabilities are a particularly salient approach to compartmentalization, but they require the entire program to assume a lack of ambient authority. Most of existing code was written under no such assumption; effectively, existing applications need to undergo a rewrite-the-world migration to reap the advantages of ocap. We propose gradual compartmentalization, an approach which allows gradually migrating an application to object capabilities, component by component in arbitrary order, all the while continuously enjoying security guarantees. The approach relies on runtime authority enforcement and tracking the authority of objects the type system. We present Gradient, a proof-of- concept gradual compartmentalization extension to Scala which uses Enclosures and Capture Tracking as its key components. We evaluate our proposal by migrating the standard XML library of Scala to Gradient.

  • Details
  • Metrics
Type
research article
DOI
10.1145/3689751
Web of Science ID

WOS:001356867600014

Author(s)
Boruch-Gruszecki, Aleksander

Charles University Prague

Ghosn, Adrien

Microsoft

Payer, Mathias  

École Polytechnique Fédérale de Lausanne

Pit-Claudel, Clement  

École Polytechnique Fédérale de Lausanne

Date Issued

2024-10-01

Publisher

ASSOC COMPUTING MACHINERY

Published in
Proceedings Of The ACM On Programming Languages-pacmpl
Issue

OOPSLA

Article Number

311

Subjects

PROTECTION

•

type systems

•

security

•

object capabilities

•

compartmentalization

•

Science & Technology

•

Technology

Editorial or Peer reviewed

REVIEWED

Written at

EPFL

EPFL units
HEXHIVE  
SYSTEMF  
FunderFunding(s)Grant NumberGrant URL

MEYS under the ERC CZ program

LL2325

Swiss National Science Foundation (SNSF)

Available on Infoscience
January 27, 2025
Use this identifier to reference this record
https://infoscience.epfl.ch/handle/20.500.14299/245431
Logo EPFL, École polytechnique fédérale de Lausanne
  • Contact
  • infoscience@epfl.ch

  • Follow us on Facebook
  • Follow us on Instagram
  • Follow us on LinkedIn
  • Follow us on X
  • Follow us on Youtube
AccessibilityLegal noticePrivacy policyCookie settingsEnd User AgreementGet helpFeedback

Infoscience is a service managed and provided by the Library and IT Services of EPFL. © EPFL, tous droits réservés