In PaaS architectures, code execution needs to be isolated to protect tenants from unauthorized access to their data by other tenants and to protect the host system from any type of intrusion by other tenants. In this paper we propose a simple and lightweight framework that provides such code execution isolation units. All design decisions taken for our framework follow well-established design principles for protection mechanisms, such that in our design we put security first. Our framework uses the process barrier and the seccomp filter mechanism to restrict access to memory and to the system call interface. For access to additional resources a request delegation scheme is used. We evaluate our implementation on a small PaaS example architecture. For plain computations, the applied techniques do not introduce any overhead.   In general, setup time for isolation units is negligible and the framework achieves acceptable throughput for broad network access. Our work brings tight and versatile isolation units to current unmodified Linux operating systems.
['Johannes Krude', 'Ulrike Meyer']
A versatile code execution isolation framework with security first