Apiary: Easy-to-Use Desktop Application Fault Containment on Commodity Operating Systems

Shaya Potter, Jason Nieh

Proceedings of the 2010 USENIX Annual Technical Conference (USENIX 2010), Boston, MA, June 22-25, 2010, pp. 103-116


Desktop computers are often compromised by the inter- action of untrusted data and buggy software. To address this problem, we present Apiary, a system that trans- parently contains application faults while retaining the usage metaphors of a traditional desktop environment. Apiary accomplishes this with three key mechanisms. It isolates applications in containers that integrate in a con- trolled manner at the display and file system. It intro- duces ephemeral containers that are quickly instantiated for single application execution, to prevent any exploit that occurs from persisting and to protect user privacy. It introduces the Virtual Layered File System to make instantiating containers fast and space efficient, and to make managing many containers no more complex than a single traditional desktop. We have implemented Api- ary on Linux without any application or operating sys- tem kernel changes. Our results with real applications, known exploits, and a 24-person user study show that Apiary has modest performance overhead, is effective in limiting the damage from real vulnerabilities, and is as easy for users to use as a traditional desktop.



Columbia University Department of Computer Science