一句话：提出基于偏序分析的动态系统调用沙箱，随程序执行逐步禁用不再需要的系统调用，降低攻击面。
系统调用沙箱通过限制程序可用的系统调用减少操作系统攻击面，但现有静态分析方法不能在运行中调整限制策略，必须允许程序功能所需的全部系统调用。本文提出一种动态系统调用沙箱，利用偏序分析将程序转换为偏序图，从而在执行任一点高效识别仍必需的系统调用；当某系统调用不再需要时立即禁用。作者在 7 个平均 615 KLOC 的常用程序（包括 Web 服务器和数据库）上评估该方法，相比 Chestnut、Temporal Specialization 和 C2C 平均多限制 23.50、16.86、15.89 个系统调用；平均抵御 1726 个利用载荷中的 83.42%，运行时开销仅 5.07%。
Attack surface reduction is a security technique that secures the operating system by removing the unnecessary code or features of a program. By restricting the system calls that programs can use, the system call sandbox is able to reduce the exposed attack surface of the operating system and prevent attackers from damaging it through vulnerable programs. Ideally, programs should only retain access to system calls they require for normal execution. Many researchers focus on adopting static analysis to automatically restrict the system calls for each program. However, these methods do not adjust the restriction policy along with program execution. Thus, they need to permit all system calls required for program functionalities. We observe that some system calls, especially security-sensitive ones, are used a few times in certain stages of a program’s execution and then never used again. This motivates us to minimize the set of required system calls dynamically. In this paper, we propose , which gradually disables access to unnecessary system calls throughout the program’s execution. To accomplish this, we utilize partial order analysis to transform the program into a partially ordered graph, which enables efficient identification of the necessary system calls at any given point during program execution. Once a system call is no longer required by the program, can restrict it immediately. To evaluate , we applied it to seven widely-used programs with an average of 615 KLOC, including web servers and databases. With partial order analysis, restricts an average of 23.50, 16.86, and 15.89 more system calls than the state-of-the-art Chestnut, Temporal Specialization, and the configuration-aware sandbox, C2C, respectively. For mitigating malicious exploitations, on average, defeats 83.42% of 1726 exploitation payloads with only a 5.07% overhead.
@article{paperbot1822,
title = {Building Dynamic System Call Sandbox with Partial Order Analysis},
author = {Quan Zhang and Chijin Zhou and Yiwen Xu and Zijing Yin and Mingzhe Wang and Zhuo Su and Chengnian Sun and Yu Jiang and Jiaguang Sun},
journal = {Proceedings of the ACM on Programming Languages},
volume = {7},
number = {OOPSLA2},
year = {2023},
doi = {10.1145/3622842}
}