FOSDEM, Brussels, 2004-02-22

Sascha Brawer
brawer@dandelis.ch

Dalibor Topić
robilad@kaffe.org

How Free Software Is Secured Using the Java Language

Java Security

Chris Gray
chris.gray@kiffer.be

Mark Wielaard
mark@klomp.org

Overview

Overview

Motivation

Anatomy of a Java-like system

Security in Java (and some problems)

Documentation, Quality assurance, Releases

Current state

Class library (GNU Classpath)

Virtual Machines (various)

How you can help

Motivation

Currently, most free software is written in C

Close to hardware

Fast execution, even
with bad compilers

Large code base,
many libraries

Ubiquitous

The Good

Easy to make
security-related bugs

Lacks “modern”
language concepts

(“modern” = 1980’ies)

Hard to write
portable code

The Bad

Libraries not
well integrated

Difficult to learn

The Ugly

Motivation

Java is a good foundation for many projects

Type safety and array bounds checking

Avoids many typical bugs, crashes, security problems

More opportunities for optimizing compilers

Modular, object-oriented, concurrent, dynamic

Easier to write structured, portable code

Very rich library, reasonably well designed (mostly)

Large developer base (“COBOL of the 1990’ies”)

There exist lots of other good (even better?) languages:
Oberon, Eiffel, O’Caml, Haskell, Erlang, TOM, Cedar, ...

But: They have not many free applications/libraries

Motivation

But: Java does not solve every problem

Over-hyped as a solution to everything

Bad reputation for wasting resources (CPU, RAM)

It is easy to write inefficient programs

Early implementations were very slow

Type safety and memory management have their cost

Often over-estimated: Array bounds checking
(→ no buffer overflows) costs ~2% execution time,
avoids ~50% security-related bugs

Syntax simplified C++ → still not very easy to learn

Java is a compromise

Not necessarily ideal, but reasonable

Plenty of free software is being written in Java

Sourceforge.net:
11,032 Java projects

Motivation

“

”

Why GNU Will Be Compatible with UNIX

Unix is not my ideal system, but it is not too bad. The essential features of Unix seem to be good ones, and I think I can fill in what Unix lacks without spoiling them. And a system compatible with Unix would be convenient for many other people to adopt.

— Richard Stallman
The GNU Manifesto, 1985

Motivation

Freedom!

Freedom to use, study, adapt, improve and share

Freedom to innovate

Not controlled by any single entity

Future: Possibility for natural, proven
(vs. committee-dictated) standards

Anatomy of a Java-like system

Java Compiler

Java → bytecode

Java Virtual Machine (JVM)

Executes bytecode (for example .jar file)

Run-time services

Bytecode interpreter

Just-in-time compiler

Garbage collection

Synchronization

...

Class library

Data structures

Networking

User interface

Database access

...

System/Library access — JNI (C calling convention)

Run-time services

About 15 JVM projects

Very diverse goals

Almost no common code (yet)

Anatomy of a Java-like system

Class library

java.{lang, math, ...}, javax.{mail, crypto, ...}

Some C code for POSIX-like systems

2

3

Java → bytecode compiler

gcj, jikes, kjc, Eclipse, ...

Complete up to Java 1.4

1.5 will need some work
for generic types: List<A>

1

1

2

3

Anatomy of a Java-like system

Ex.: Jikes Compiler

71,000 lines of code

~ 17.5 person-years

~ USD 2.4 Mio.

Java compiler

Ex.: Kissme VM

59,000 lines of code

~ 14.5 person-years

~ USD 2.0 Mio.

Run-time serv.

Ex.: GNU Classpath

233,000 lines of code

~ 61.5 person-years

~ USD 8.3 Mio.

Class library

Very coarse estimates!

Generated using http://dwheeler.com/
sloccount/

“Basic COCOMO”

1

2

3

1

2

3

GNU Classpath is shared
among many VM projects

“Upstream” provider
for the class library

java.*, most javax.*

Mainly for historical reasons,
certain javax.* are provided
by other projects

Common code base,
bug tracking, ...

Very permissive license

GNU Classpath

Jikes RVM

Kaffe

Jupiter

IKVM.NET

AegisVM

GNU Classpath

. . .

JamVM

Free software is flexible

Done with GNU Classpath:

Compiling Java source → stand-alone executable

Compiling Java bytecode → CIL (bytecode of .NET)

Operating Systems with type-safe kernels

JVM for multiprocessor clusters (128 CPUs, Myrinet)

Embedded systems with real-time guarantees

Alternative access to native system/libs (non-JNI)

Free Software can be adapted
to arbitrary needs → innovation

Security in Java: Actors

Actors in Java security

Java-to-Bytecode compiler

no (struct t*)((char*) p + 8)

Verifier

bytecode must be well-formed

Virtual Machine

run-time checks, e.g. dereferencing null

Class libraries

ACL-based security checks

Security in Java: Levels

0. Type safety, array bounds checking

ensured by: Compiler, Verifier

1. Encapsulation (private, protected, etc.)

ensured by: Compiler, Verifier

2. Fine-grained access control

Access Control Lists

based on code source

Security in Java: Architecture

java.lang

1

Class

ProtectionDomain

*

.jars can be signed

*

ClassLoader

1

CodeSource

PermissionCollection

+implies(p:Permission):boolean

Permission

FilePermission

-path: String

-actionString: String

-location: URL

-certs: Certificate[]

1

*

1

*

From policy config. file:

grant codeBase
“http://www.foo.org/code”
{

permission

java.io.FilePermission

“/tmp/*”, “read”;

};

Security in Java: Architecture

package java.io;

public class File

{

private String path;

public void delete()

{

Permission p = new FilePermission(path, “delete”);

System.getSecurityManager().checkPermission(p);

}

}

java.lang.SecurityManager.checkPermission

java.io.File.delete

org.foo.Wombat.someMethod

org.foo.Wombat.main

Call Stack

?

For each method on the call stack:

Does the PermissionCollection
of its ProtectionDomain imply p?

If not, throw SecurityException

Security in Java: Problems

Denial-of-service attacks

class MemoryAttacker

{

public void foo()

{

List x = new LinkedList();

while (true)

x.add(“abc”);

}

}

DoS on memory management:

Excessive heap allocation

import java.awt.*;

class CPUAttacker

extends java.awt.Component

{

public void paint(Graphics g)

{

while (true)

;

}

}

DoS on AWT (GUI) thread:

Excessive CPU consumption

Security in Java: Problems

Denial-of-service attacks

class FinalizationAttacker

{

public void finalize()

{

while (true)

;

}

}

DoS on class finalization thread

class ClassLoaderAttacker

{

public void attack()

{

synchronized (foo
.getClass()
.getClassLoader())

{

while (true)

;

}

}

}

DoS on Virtual Machine:

Deadlock upon class loading

ECOOP ’02 Workshop on Resource Mana- gement for Safe Languages

Security in Java: Further reading

Gary McGraw and Ed Felten. Securing Java: Getting Down to Business with Mobile Code. John Wiley & Sons, 1999. 324 pages.
Also available online at http://www.securingjava.com/

http://www.ovmj.org/workshops/
resman/

Quality assurance

Test suite

~100,000 tests

We need many more!

Key to reliability

Tests are very
easy to write

// Tags: JDK1.0

package gnu.testlet.java.util.Stack;

import java.util.Stack;

import gnu.testlet.*;

public class empty
extends Testlet

{

public void test(TestHarness h)

{

Stack stack = new Stack();

// Check #1.

h.check(stack.empty());

// Check #2.

stack.push(“abc”);

h.check(!stack.empty());

}

}

Test for java.util.Stack.empty()

http://sources.redhat.com/mauve/

Releases

Now: Version 0.08

Time-based release schedule

Every three months,
a new 0.0x release

Already quite usable for real applications

“0.08” may be too modest a name

For v1.0, we need:

Fixed VM interface

Complete implementation of supported packages

Define “supported”!

Full test coverage

Full documentation
of the API

Start of a real manual?

What’s working?

Eclipse IDE

UI: SWT (not AWT)

eclipse.org

Tomcat

Container for Servlets
and JavaServer Pages

jakarta.apache.org

Current state

J2SE 1.3/1.4 (Desktop)

Source: GNU Classpath

License: GPL + “Compiler exception”

Allows static linking with proprietary closed-source code
and into embedded systems → very permissive

No formal compliance with any specification

java.beans[.beancontext], java.io, java.lang[.ref, .reflect], java.math, java.net, java.nio.charset[.spi] (only SPI), java.rmi[.activation, .dgc,
.registry, .server], java.security[.acl, .cert, .interfaces, .spec], java.sql, java.text, java.util[.jar, .logging, .zip]

javax.naming[.directory, .ldap, .spi],
javax.swing.[border, plaf], javax.transaction[.xa]

Current state

J2SE 1.4 (Desktop), partial implementation

java.applet, java.awt, java.awt.event, java.awt.geom,
java.awt.image[.renderable], java.nio[.channels, .spi], java.util.prefs

javax.accessibility, javax.print[.*] (only SPI), javax.swing.undo

J2SE 1.4 (Desktop), lots of work/nothing there

java.awt.color, java.awt.font, java.awt.im[.spi],
java.nio.charset (service providers)

javax.imageio[.*], javax.print (service providers), javax.rmi[.CORBA],
java.security.auth[.*], javax.swing[.colorchooser, .event,
.filechooser, .plaf.basic, .plaf.metal, .plaf.multi, .table,
.text, .text.html, .text.html.parser, .text.rtf, .tree]

org.ietf.jgss, org.omg[.*]

Current state

Various standard packages

Licenses: Various (but all “free”)

No formal compliance with any specification

javax.sound

Service providers for
ALSA, esd, lame, ogg

Tritonus Project

javax.crypto

Service providers for
many crypto algorithms

GNU Crypto

java.util.regex

GNU regex

javax.activation
javax.infobus
javax.mail
javax.servlet

GNU Classpath Extensions

javax.speech

Text-to-Speech
(no recognition)

FreeTTS

javax.net
javax.net.ssl
javax.security.cert

SSL/TLS Support

Jessie

Current state

J2EE 1.4 (Server)

Multi-tier stack: web services/enterprise computing

Multiple free implementations: JBoss.org, Jonas

Needs some (not much) work to combine it all

Conformance: JBoss.org has recently licensed the J2EE1.4 compliance kit from Sun microsystems

Now making sure that JBoss.org satisfies the test suite

Will afterwards be certified as compliant

javax.activation, javax.ejb[.spi], javax.enterprise[.*], javax.jms,
javax.mail[.*], javax.management[.*], javax.resource[.*],
javax.security.jacc, javax.servlet[.*], javax.transaction[.xa], javax.xml.*

Current state

Plenty of free software is being written in Java

sourceforge.net: 11,032 Java projects

Support for multiple other programming languages

GNU KAWA: Scheme, Common Lisp, eLisp, ECMAScript, ...

Jython, JRuby

Traditional free libraries with Java bindings

GTK+, GNOME, glade, gconf, vte, ...

Will be part of the official language bindings
in GNOME 2.6

GNU gettext, getopt, readline, ...

How you can help

Any help is greatly appreciated

Test Java programs on free Virtual Machines

Write test cases for Mauve

Write intellegible documentation

Implement library classes

Fund development

How to proceed

Look at the task list

http://www.gnu.org/
software/classpath/

Both easy and tricky tasks

Ask us for details:
classpath@gnu.org

Copyrights must get assigned to FSF

Happy hacking!

How you can help with security

Security in Classpath

We have 90% of the Java security framework

... and need you
for the second 90%!

Code audit

do we call checkPermission()
where needed?

GNU Crypto

Security in VMs

Type safety proved by bytecode verification

VM-specific

no free VMs do it yet
in full

Code audit

Sascha Brawer

2003-12-30T11:42:18