Making 'syscall' a Privilege not a Right
Fangfei Yang, Anjo Vahldiek-Oberwagner, Chia-Che Tsai, Kelly Kaoudis, and Nathan Dautenhahn

TL;DR
This paper introduces nexpoline, a novel mechanism for secure, efficient, and flexible syscall interception that operates without kernel modifications, enhancing sandbox security and performance on Linux systems.
Contribution
Nexpoline combines Memory Protection Keys and seccomp or SUD to transform syscalls into privileged instructions, enabling secure, flexible, and high-performance syscall mediation without kernel changes.
Findings
Nexpoline outperforms ptrace in interception overhead.
Supports complex policies and system resource emulation.
Operates without requiring root privileges.
Abstract
Browsers, Library OSes, and system emulators rely on sandboxes and in-process isolation to emulate system resources and securely isolate untrusted components. All access to system resources like system calls (syscall) need to be securely mediated by the application. Otherwise system calls may allow untrusted components to evade the emulator or sandbox monitor, and hence, escape and attack the entire application or system. Existing approaches, such as ptrace, require additional context switches between kernel and userspace, which introduce high performance overhead. And, seccomp-bpf supports only limited policies, which restricts its functionality, or it still requires ptrace to provide assistance. In this paper, we present nexpoline, a secure syscall interception mechanism combining Memory Protection Keys (MPK) and Seccomp or Syscall User Dispatch (SUD). Our approach transforms an…
Peer Reviews
No public reviews on file for this paper yet. If you reviewed it on a platform where reviews are public (OpenReview, ICLR, NeurIPS, ICML), you can paste yours below so the community can read it here.
Videos
No videos yet. Explain this paper in a talk, walkthrough, or lecture? Add one.
Taxonomy
TopicsEuropean Monetary and Fiscal Policies
