Search papers, labs, and topics across Lattice.
This paper introduces SysComb, an innovative eBPF-based system that implements fine-grained, state-aware system call filtering without requiring modifications to either the application or the kernel. By allowing developers to choose between seccomp-like and least-privilege enforcement strategies, SysComb effectively reduces the attack surface of applications while maintaining operational integrity. Evaluation results indicate that SysComb achieves accurate filtering with overhead comparable to existing kernel solutions, highlighting its practicality for real-world applications.
SysComb enables state-aware system call filtering without the need for intrusive modifications, significantly enhancing application security with minimal performance overhead.
Restricting the system calls available to applications shrinks the kernel's attack surface and greatly mitigates the impact of compromised programs. Recent approaches showcase techniques to generate system call filters, however, all existing solutions require either kernel or application modifications to activate them at runtime. This is intrusive, error-prone, and often impractical, especially when the code is maintained by external parties. This paper presents SysComb, a novel eBPF-based solution to enforce temporally-specialized system call filters based on the application state, without requiring any modification to the application or the kernel code, and thus addressing the above limitations. Moreover, SysComb lets the developer choose between two distinct enforcement strategies: seccomp-like, ensuring no new privileges are gained after a state transition is performed, and least-privilege, which applies to each state the most restrictive filter. We evaluated SysComb using widely used software, showcasing accurate state-aware system call filtering and an overhead comparable to built-in kernel solutions, demonstrating the practicality of our approach.
