Security policy realization in an extensible operating system

We describe the practical application of security to extensible operating systems, focusing on the SPIN extensible OS. Because SPIN and other extensible operating systems support the loading of user-developed extensions directly into the kernel, they require the application of traditional user-level security in addition to kernel-level security, to prevent kernel extensions from subverting kernel functionality. In order to show that such an approach to extensible OS security is possible and practical, we augmented the existing security architecture of SPIN, maintaining the separation between policy mediation and enforcement. Several well-known user-level policies, described here, are supported in the architecture. In addition, we have introduced kernel-level security through the separation of kernel code into segments and the enforcement of a domain/type policy on threads as they progress through system code. Finally, we have devised a useful domain/type policy extensibility strategy that is conservative, but preserves the existing policy