SXE - SxeMonitor

Introduction

As part of the SXE, a privileged Qt Extended system process known as SxeMonitor monitors security. SxeMonitor runs as a lightweight process that responds to security policy breaches. If an an untrusted application breaches policy the following steps are taken:

• The errant application is terminated.
• The errant application is disabled to prevent restart
• The user is notifed via dialog
• The user is sent a notification via synthetic SMS.

The Package Manager can be used to re-enable a disabled application.

Deleting or uninstalling the application automatically may not be desirable as:

• if the application is DRM controlled, removal of the rights object may mean the application cannot be accessed by the user without paying for the DRM controlled package again
• if the user has created content, using the application that content may be inaccessible after uninstalling the application
• given that the program is flawed or malicious the SXE system could ask the user to forward the package for analysis:
  • to protect the user from for example being unfairly billed by a network provider
  • to counter further spread or activity of the program.

If suspicous activity is detected but there is difficulty in isolating the errant application, then a lockdown state is initiated which:

• Terminates all untrusted applications
• Disables all untrusted applications
• Notify the user via dialog
• Notify the user via synthetic SMS

A scenario when this might happen is during a brute force attack to guess the keys of trusted programs, if the number of negative authentications exceed the false authentication rate (currently hardcoded to 5 per minute), then all downloaded applications terminated and disabled.

Breaches are communicated to the SxeMonitor via a security log. The log serves to decouple the SxeMonitor from the rest of the Qt Extended system so that the integrity of the monitor is maintained even if other parts of Qt Extended are compromised or exploited. The cost of this decoupling is the time to react, as preiviously mentioned it is possible that an errant forked process can die before the SxeMonitor has a chance to identify what program it belonged to, nevertheless malicous programs still will not have access to any sensitive resources.

    [Log]
    Size = 1048576
    Path = /mnt/documents/.log/sxe.log
    StampFormat="^([A-Z][a-z]{2}\\s+\\d{1,2}\\s+\\d{2}:\\d{2}:\\d{2}[^:]*qpe:\\s)(.*)$"
    LidsStampFormat="^([A-Z][a-z]{2}\\s+\\d{1,2}\\s+\\d{2}:\\d{2}:\\d{2}[^:]*kernel:\\s)LIDS:.*\\(dev.*\\) pid (\\d*) ppid.*:(.*)$"