Producing Hook Placements to Enforce Expected Access Control Policies

摘要: Many security-sensitive programs manage resources on behalf of mutually distrusting clients. To control access to resources, authorization hooks are placed before operations those resources. Manual hook placements by programmers often incomplete or incorrect, leading insecure programs. We advocate an approach that automatically identifies the set locations place mediates all in order enforce expected policies at deployment. However, one challenge is want minimize effort writing such policies. As a result, they may remove believe unnecessary, but too many hooks, preventing enforcement some desirable