Add Temporal Variant for Cambridge/SRI to Instance Configurations

[andrew-bivin]

@brooksdavis would "Temporal Safety" be an appropriate name for this variant within FETT Portal?

[brooksdavis]

@brooksdavis would "Temporal Safety" be an appropriate name for this variant within FETT Portal?

If this is to go in the "Variant" column you could use you could potentially go with "temporal", but "Temporal Safety" or "Userspace Temporal Safety" would be more descriptive.

[alex-fivetalent]

@brooksdavis, @Abivin12. We used the variant column as a codename with description of the difference being in the Learn section. In terms of spacing in the dashboard it seems like it works better as a single word, although I get that it's not as descriptive. We just used purecap for the last one rather than pure-capability kernel.

[jrtc27]

Then maybe the best approach is to stick with "temporal" in the column and make sure Learn is suitably descriptive (as it would be anyway)?

[alex-fivetalent]

Along those lines, maybe we can consolidate the common features the Cambridge/SRI releases in Learn and then highlight specific differences in variants afterwards for ease of use.

[jrtc27]

Half of this issue is now done (the new instance type is live) but Learn remains unchanged, lacking Release 3 information.

[jrtc27]

Thinking about consolidating the documentation, currently we have:

SRI/Cambridge Release 1 ("default variant")

• CPU: Bluespec P2 w/CHERI extension
  • OS: CheriBSD (CHERI-extended FreeBSD)
  • Contains a pure capability userspace and a hybrid capability kernel
  • Applications:
  • Web Server (nginx v.1.13.12)
  • Database (sqlite v.3.22.0)
  • SSH Daemon (OpenSSH 7.3)
  • FETT-Voting voter registration application
  • Additional applications modified to incorporate CHERI protections
  • Researcher-provided and compiled vulnerable applications
  • Security researchers are given access to a root shell to interact with custom applications via "su -"
• FAQ:
  • You can reboot this instance type with one of the following procedures:
  • Through the ssh connection: Invoke su, then invoke reboot. [Recommended]
  • Through the piped UART on port 8278, Ctrl-a + r may also be used for a hard reset. [Advised to use only when the target is non-responsive.]

SRI/Cambridge Release 2 ("purecap variant")

• CPU: Bluespec P2 w/CHERI extension
  • OS: CheriBSD (CHERI-extended FreeBSD)
  • Enhanced with a pure-capability kernel providing protection from many spatial memory-safety issues
  • Applications:
  • Web Server (nginx v.1.13.12)
  • Database (sqlite v.3.22.0)
  • SSH Daemon (OpenSSH 7.3)
  • FETT-Voting voter registration application
  • Additional applications modified to incorporate CHERI protections
  • Researcher-provided and compiled vulnerable applications
  • NFS v4 server exporting /
  • Reintroduced kernel vulnerabilities (known to be exploitable on a conventional RISC-V kernel):
  • FreeBSD-SA-18:13.nfs
  • FreeBSD-SA-09:06.ktimer
  • Security researchers are given access to a root shell to interact with custom applications via "su -"
• FAQ:
  • You can reboot this instance type with one of the following procedures:
  • Through the ssh connection: Invoke su, then invoke reboot. [Recommended]
  • Through the piped UART on port 8278, Ctrl-a + r may also be used for a hard reset. [Advised to use only when the target is non-responsive.]

My attempt at both combining them and integrating temporal safety would be:

SRI/Cambridge

• CPU: Bluespec P2 w/CHERI extension
  • OS: CheriBSD (CHERI-extended FreeBSD)
  • Contains a pure capability userspace and either a hybrid capability kernel or a pure capability kernel (see Variants below)
  • Applications:
  • Web Server (nginx v.1.13.12)
  • Database (sqlite v.3.22.0)
  • SSH Daemon (OpenSSH 7.3)
  • FETT-Voting voter registration application
  • Additional applications modified to incorporate CHERI protections
  • Researcher-provided and compiled vulnerable applications
  • Security researchers are given access to a root shell to interact with custom applications via "su -"
• Variants:
  • Release 1 ("default variant")
  • OS:
    • Contains a hybrid capability kernel
  • Release 2 ("purecap variant")
  • OS:
    • Contains a pure capability kernel
  • Additional applications:
    • NFS v4 server exporting /
  • Reintroduced kernel vulnerabilities (known to be exploitable on a conventional RISC-V kernel):
    • FreeBSD-SA-18:13.nfs
    • FreeBSD-SA-09:06.ktimer
  • Release 3 ("temporal variant")
  • OS:
    • Contains a hybrid capability kernel
    • Adds userspace heap temporal safety
  • Additional applications:
    • NFS v4 server exporting /
• FAQ:
  • You can reboot this instance type with one of the following procedures:
  • Through the ssh connection: Invoke su, then invoke reboot. [Recommended]
  • Through the piped UART on port 8278, Ctrl-a + r may also be used for a hard reset. [Advised to use only when the target is non-responsive.]

@brooksdavis / @alex-fivetalent / @Abivin12 thoughts?

[alex-fivetalent]

That was along the lines I was imagining.

[brooksdavis]

I'm fairly sure we've got the nfs server on Release 3 as well. Booting now to verify.

[jrtc27]

If so you should have permission to edit my comment to include it

[brooksdavis]

If so you should have permission to edit my comment to include it

Verified and updated the comment.