Trustworthy whole-system provenance for the Linux kernel

TLDR

Provenance-aware systems collect metadata to trace object histories, yet securing provenance—ensuring its authenticity and integrity—is an underexplored challenge. The authors introduce Linux Provenance Modules (LPM), a general framework for building provenance-aware systems, and illustrate its utility by designing a Provenance-Based Data Loss Prevention (PB‑DLP) system. LPM implements secure provenance layering and authenticated inter-host communication, interoperates with existing mechanisms for strong security, and deploys PB‑DLP as a file‑transfer application that blocks sensitive‑derived files with only tens of milliseconds overhead. Experiments show LPM provides a trusted whole‑system provenance environment with only 2.7 % performance overhead, PB‑DLP effectively blocks sensitive file transfers, and LPM represents a first step toward widespread trustworthy provenance deployment.

Abstract

In a provenance-aware system, mechanisms gather and report metadata that describes the history of each object being processed on the system, allowing users to understand how data objects came to exist in their present state. However, while past work has demonstrated the usefulness of provenance, less attention has been given to securing provenance-aware systems. Provenance itself is a ripe attack vector, and its authenticity and integrity must be guaranteed before it can be put to use. We present Linux Provenance Modules (LPM), the first general framework for the development of provenance-aware systems. We demonstrate that LPM creates a trusted provenance-aware execution environment, collecting complete whole-system provenance while imposing as little as 2.7% performance overhead on normal system operation. LPM introduces new mechanisms for secure provenance layering and authenticated communication between provenance-aware hosts, and also interoperates with existing mechanisms to provide strong security assurances. To demonstrate the potential uses of LPM, we design a Provenance-Based Data Loss Prevention (PB-DLP) system. We implement PBDLP as a file transfer application that blocks the transmission of files derived from sensitive ancestors while imposing just tens of milliseconds overhead. LPM is the first step towards widespread deployment of trustworthy provenance-aware applications.