\HeadingLevelC{Operating System Protection}
\label{sec:os_protection}

Sanctum protects the operating system from direct attacks against malicious
enclaves, but does not protect it against subtle attacks that take advantage of
side-channels. Sanctum assumes that software developers will transition all
sensitive software into enclaves, which are protected even if the OS is
compromised. At the same time, a honest OS can potentially take advantage of
Sanctum's DRAM regions to isolate mutually mistrusting processes.

Proving that a malicious enclave cannot attack the host computer's operating
system is accomplished by first proving that the security monitor's APIs that
start executing enclave code always place the core in unprivileged mode, and
then proving that the enclave can only access OS memory using the OS-provided
page tables. The first claim can be proven by inspecting the security monitor's
code. The second claim follows from the correctness proof of the circuits
 in \S~\ref{sec:pmh_walker_input} and \S~\ref{sec:pmh_walker}.
Specifically, each enclave can only access memory either via its own page tables or
the OS page tables, and the enclave's page tables cannot point into the DRAM
regions owned by the OS.

These two claims effectively show that Sanctum enclaves run with the privileges
of their host application. This parallels SGX, so all
arguments about OS security in SGX apply to Sanctum
as well. Specifically, malicious enclaves cannot DoS the OS, and can be
contained using the mechanisms that currently guard against malicious user
software.
