Types and Abstract Interpretation for Authorization Hook Advice - Skalka, Christian; Darais, David; Jaeger, Trent; Capobianco, Frank (Proceedings (IEEE Computer Security Foundations Symposium), 2020)
Authorization hooks are access control checks that prevent unauthorized principals from interacting with some protected resource, and are used extensively in critical software such as operating systems, middleware, and server programs. They are often intended to mediate information flow between subjects (e.g., file owners), but typically in an ad-hoc manner. In this paper we present a static type and effect system for detecting whether authorization hooks in programs properly defend against undesired information flow between subjects. A significant novelty of our approach is an integrated abstract interpretation-based tool that guides system clients through the information flow consequences of access control policy decisions.