Wedge: Splitting Applications into Reduced-Privilege Compartments

No abstract is available for this paper.

• Publication year

  2008

• Venue

  Symposium on Networked Systems Design and Implementation

• Publication date

  2008-04-16

• Fields of study

  Computer Science

• Identifiers

  No identifiers available.

• External record

  Open on Semantic Scholar

• Source metadata

  Semantic Scholar

• No claims are published for this paper.

• No concepts are published for this paper.

• Information flow control for standard OS abstractions

  2007influential reference
• Making information flow explicit in HiStar

  2006cited by this paper
• Labels and event processes in the asbestos operating system

  2005influential reference
• Fuss , Futexes and Furwocks : Fast Userlevel Locking in Linux Hubertus Franke IBM

  2005cited by this paper
• Make Least Privilege a Right (Not a Privilege)

  2005cited by this paper
• Pin: building customized program analysis tools with dynamic instrumentation

  2005cited by this paper
• Side Effects Are Not Sufficient to Authenticate Software

  2004influential reference
• Preventing Privilege Escalation

  2003cited by this paper
• USENIX Association Proceedings of the FREENIX Track : 2003 USENIX Annual

  2003cited by this paper
• Untrusted hosts and confidentiality: secure program partitioning

  2001cited by this paper
• Protecting privacy using the decentralized label model

  2000cited by this paper
• SSL and TLS: Designing and Building Secure Systems

  2000cited by this paper
• The protection of information in computer systems

  1975cited by this paper
• Proceedings of the Freenix Track: 2001 Usenix Annual Technical Conference Integrating Flexible Support for Security Policies into the Linux Operating System

  year unknowncited by this paper
• Proceedings of the General Track: 2004 Usenix Annual Technical Conference Building Secure High-performance Web Services with Okws

  year unknowncited by this paper

• Fipa: Fine-Grained Information-Flow-Driven Program Partitioning

  2026cites this paper
• ADPP: Automated Data-Centric Program Partitioning

  2025cites this paper
• TypeFlexer: Type Directed Flexible Program Partitioning

  2025cites this paper
• Unlocking True Elasticity for the Cloud-Native Era with Dandelion

  2025cites this paper
• More Granular, Less Trust: Enforcing Intra-Process Isolation With Arm CCA in an Untrusted Management Environment

  2025cites this paper
• $ZTD_{\text{JAVA}}$: Mitigating Software Supply Chain Vulnerabilities via Zero-Trust Dependencies

  2025cites this paper
• EPScan: Automated Detection of Excessive RBAC Permissions in Kubernetes Applications

  2025cites this paper
• SECOMP: Formally Secure Compilation of Compartmentalized C Programs

  2024cites this paper
• Gradient: Gradual Compartmentalization via Object Capabilities Tracked in Types

  2024cites this paper
• Toast: A Heterogeneous Memory Management System

  2024cites this paper
• SoK: Software Compartmentalization

  2024cites this paper
• Fast Core Scheduling with Userspace Process Abstraction

  2024cites this paper
• Securing Monolithic Kernels using Compartmentalization

  2024cites this paper
• Dorami: Privilege Separating Security Monitor on RISC-V TEEs

  2024cites this paper
• BULKHEAD: Secure, Scalable, and Efficient Kernel Compartmentalization with PKS

  2024cites this paper
• Information Flow Tracking for Heterogeneous Compartmentalized Software

  2023influential citation
• Harnessing the x86 Intermediate Rings for Intra-Process Isolation

  2023cites this paper
• Thread-Level Attack-Surface Reduction

  2023cites this paper
• Endoprocess: Programmable and Extensible Subprocess Isolation

  2023cites this paper
• Secure Partitioning of Cloud Applications, with Cost Look-Ahead

  2023cites this paper
• ABSLearn: a GNN-based framework for aliasing and buffer-size information retrieval

  2023cites this paper
• Software Compartmentalization Trade-Offs with Hardware Capabilities

  2023cites this paper
• Whole-Program Privilege and Compartmentalization Analysis with the Object-Encapsulation Model

  2023cites this paper
• Credit Karma: Understanding Security Implications of Exposed Cloud Services through Automated Capability Inference

  2023cites this paper
• DynaCut: A Framework for Dynamic and Adaptive Program Customization

  2023cites this paper
• Enabling Lightweight Privilege Separation in Applications with MicroGuards

  2023cites this paper
• CheckedCBox: Type Directed Program Partitioning with Checked C for Incremental Spatial Memory Safety

  2023cites this paper
• HODOR: Shrinking Attack Surface on Node.js via System Call Limitation

  2023cites this paper
• μSwitch: Fast Kernel Context Isolation with Implicit Context Switches

  2023cites this paper
• Capacity: Cryptographically-Enforced In-Process Capabilities for Modern ARM Architectures

  2023cites this paper
• ISA-Grid: Architecture of Fine-grained Privilege Control for Instructions and Registers

  2023influential citation
• VDom: Fast and Unlimited Virtual Domains on Multiple Architectures

  2023cites this paper
• Dynamic Linkers Are the Narrow Waist of Operating Systems

  2023cites this paper
• FreePart: Hardening Data Processing Software via Framework-based Partitioning and Isolation

  2023cites this paper
• Creating Trust by Abolishing Hierarchies

  2023cites this paper
• Put Your Memory in Order: Efficient Domain-based Memory Isolation for WASM Applications

  2023cites this paper
• ZTD$_{JAVA}$: Mitigating Software Supply Chain Vulnerabilities via Zero-Trust Dependencies

  2023cites this paper
• You shall not (by)pass!: practical, secure, and fast PKU-based sandboxing

  2022cites this paper
• Annotating, Tracking, and Protecting Cryptographic Secrets with CryptoMPK

  2022cites this paper
• Polytope: Practical Memory Access Control for C++ Applications

  2022cites this paper
• CAP-VMs: Capability-Based Isolation and Sharing in the Cloud

  2022cites this paper
• The Next-Generation OS Process Abstraction

  2022cites this paper
• CAP-VMs: Capability-Based Isolation and Sharing for Microservices

  2022cites this paper
• Operating System Support for Safe and Efficient Auxiliary Execution

  2022influential citation
• A systematic analysis of the event-stream incident

  2022cites this paper
• PKRU-safe: automatically locking down the heap between safe and unsafe languages

  2022cites this paper
• Towards Practical Application-level Support for Privilege Separation

  2022cites this paper
• CubicleOS: a library OS with software componentisation for practical isolation

  2021cites this paper
• Spons & Shields: practical isolation for trusted execution

  2021cites this paper
• Domain Page-Table Isolation

  2021cites this paper
• Kard: lightweight data race detection with per-thread memory protection

  2021cites this paper
• Isolation Without Taxation: Near Zero Cost Transitions for SFI

  2021cites this paper
• Preventing Dynamic Library Compromise on Node.js via RWX-Based Privilege Reduction

  2021influential citation
• Enclosure: language-based restriction of untrusted libraries

  2021influential citation
• When Good Components Go Bad: Formally Secure When Good Components Go Bad: Formally Secure Compilation Despite Dynamic Compromise Compilation Despite Dynamic Compromise

  2021cites this paper
• SCALPEL: Exploring the Limits of Tag-enforced Compartmentalization

  2021cites this paper
• μSCOPE: A Methodology for Analyzing Least-Privilege Compartmentalization in Large Software Artifacts

  2021cites this paper
• Twizzler: A Data-centric OS for Non-volatile Memory

  2021cites this paper
• The Endokernel: Fast, Secure, and Programmable Subprocess Virtualization

  2021cites this paper
• Making Information Hiding Effective Again

  2021cites this paper
• Garmr: Defending the gates of PKU-based sandboxing

  2021cites this paper
• Isolation without taxation: near-zero-cost transitions for WebAssembly and SFI

  2021cites this paper
• Faastlane: Accelerating Function-as-a-Service Workflows

  2021cites this paper
• Flightplan: Dataplane Disaggregation and Placement for P4 Programs

  2021cites this paper
• Virtines: Virtualization at Function Call Granularity

  2021cites this paper
• Cali: Compiler-Assisted Library Isolation

  2021cites this paper
• Fast and secure Global-Heap for memory-centric computing

  2021cites this paper
• Demons in the Shared Kernel: Abstract Resource Attacks Against OS-level Virtualization

  2021cites this paper
• Fine-grained Program Partitioning for Security

  2021cites this paper
• Isolating functions at the hardware limit with virtines

  2021influential citation
• Fine-Grained Isolation for Scalable, Dynamic, Multi-tenant Edge Clouds

  2020cites this paper
• Donky: Domain Keys - Efficient In-Process Isolation for RISC-V and x86

  2020cites this paper
• PKU Pitfalls: Attacks on PKU-based Memory Isolation Systems

  2020cites this paper
• SEIMI: Efficient and Secure SMAP-Enabled Intra-process Memory Isolation

  2020cites this paper
• Sirius: Enabling System-Wide Isolation for Trusted Execution Environments

  2020cites this paper
• Hardware-Based Domain Virtualization for Intra-Process Isolation of Persistent Memory Objects

  2020cites this paper
• Fine-Grained Isolation to Protect Data against In-Process Attacks on AArch64

  2020cites this paper
• Enclosures : language-based restriction of untrusted libraries Extended Abstract

  2020cites this paper
• $μ$Tiles: Efficient Intra-Process Privilege Enforcement of Memory Regions

  2020cites this paper
• Retrofitting Fine Grain Isolation in the Firefox Renderer (Extended Version)

  2020cites this paper
• Debugging strongly-compartmentalized distributed systems

  2020cites this paper
• Mir: Automated Quantifiable Privilege Reduction Against Dynamic Library Compromise in JavaScript

  2020cites this paper
• Retrofitting the Partially Privileged Mode for TEE Communication Channel Protection

  2020cites this paper
• Securing UnSafe Rust Programs with XRust

  2020cites this paper
• Enclave-Aware Compartmentalization and Secure Sharing with Sirius

  2020cites this paper
• Faasm: Lightweight Isolation for Efficient Stateful Serverless Computing

  2020cites this paper
• Ignis: scaling distribution-oblivious systems with light-touch distribution

  2019cites this paper
• Program-mandering: Quantitative Privilege Separation

  2019cites this paper
• In-process Memory Isolation Using Hardware Watchpoint

  2019cites this paper
• The Quest for Formally Secure Compartmentalizing Compilation

  2019cites this paper
• Efficient, Dynamic Multi-tenant Edge Computation in EdgeOS

  2019cites this paper
• libmpk: Software Abstraction for Intel Memory Protection Keys (Intel MPK)

  2019cites this paper
• Operator, number please : mediating access to shared resources for efficiency and isolation

  2019cites this paper
• EnclaveDom: Privilege Separation for Large-TCB Applications in Trusted Execution Environments

  2019cites this paper
• Secured Routines: Language-based Construction of Trusted Execution Environments

  2019cites this paper
• ERIM: Secure, Efficient In-process Isolation with Protection Keys (MPK)

  2019influential citation
• SafeHidden: An Efficient and Secure Information Hiding Technique Using Re-randomization

  2019cites this paper
• Pyronia: Intra-Process Access Control for IoT Applications

  2019cites this paper
• Narrowing the Gap Between Serverless and its State with Storage Functions

  2019cites this paper
• Pyronia: Redesigning Least Privilege and Isolation for the Age of IoT

  2019cites this paper