2023/02/20 by Jinghao Jia, Jia, Jinghao, Dan Williams +16 · 15 citations
Computer Science · Social Sciences · #Access Control and Trust #Advanced Malware Detection Techniques #Attack surface #Computer network #Computer science #Computer security #Context (archaeology) #Context switch #Linux kernel #Operating system #Overhead (engineering) #Programming language #Protection mechanism #Security and Verification in Computing #State (computer science) #Stateful firewall #Synchronization (alternating current) #System call
paper · pdf · doi:10.48550/arxiv.2302.10366
published in arXiv (Cornell University) (Cornell University)
openalex publication_date 2023/02/20 · openalex created_date 2025/10/10 · openalex updated_date 2026/08/06
System call filtering is a widely used security mechanism for protecting a shared OS kernel against untrusted user applications. However, existing system call filtering techniques either are too expensive due to the context switch overhead imposed by userspace agents, or lack sufficient programmability to express advanced policies. Seccomp, Linux's system call filtering module, is widely used by modern container technologies, mobile apps, and system management services. Despite the adoption of the classic BPF language (cBPF), security policies in Seccomp are mostly limited to static allow lists, primarily because cBPF does not support stateful policies. Consequently, many essential security features cannot be expressed precisely and/or require kernel modifications. In this paper, we present a programmable system call filtering mechanism, which enables more advanced security policies to be expressed by leveraging the extended BPF language (eBPF). More specifically, we create a new Seccomp eBPF program type, exposing, modifying or creating new eBPF helper functions to safely manage filter state, access kernel and user state, and utilize synchronization primitives. Importantly, our system integrates with existing kernel privilege and capability mechanisms, enabling unprivileged users to install advanced filters safely. Our evaluation shows that our eBPF-based filtering can enhance existing policies (e.g., reducing the attack surface of early execution phase by up to 55.4% for temporal specialization), mitigate real-world vulnerabilities, and accelerate filters.