Kernel System Call Filter for ABI Restriction
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing systems face challenges in reducing the kernel attack surface due to numerous system calls available via application binary interfaces (ABIs), which can be exploited by attackers, and conventional system call filtering methods are ineffective against attacks involving malicious code spawned by privileged processes.
Innovation Solution
Implementing a system call filter activated directly by the operating system kernel, using mechanisms like Berkley Packet Filtering (BPF) to intercept and restrict unnecessary system calls across all user space applications, thereby reducing the kernel attack surface by inhibiting specific ABIs and performing predefined actions when prohibited calls are attempted.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If numerous system calls are made available via ABI for user space programs, then program functionality and adaptability are improved, but the kernel attack surface increases and security deteriorates
Solution Approach 1:
The patent segments the system call interface by introducing separate ABI variants (e.g., first ABI and second ABI) with different system call sets. Each ABI is tailored to specific program types, allowing the kernel to expose only necessary system calls to each program category, thereby reducing the overall attack surface while maintaining functionality for authorized programs.
Solution Approach 2:
Different ABIs are provided with different qualities of system call access based on local requirements. The first ABI includes a first set of system calls suitable for certain program types, while the second ABI includes a second set for other program types. This local differentiation ensures each program receives exactly the system calls it needs, minimizing unnecessary exposure.
2Object-affected harmful factors
If system call filtering is implemented to reduce attack surface, then security is improved, but device complexity increases
Solution Approach 1:
The kernel pre-configures multiple ABIs with predetermined system call sets before program execution. Instead of implementing dynamic filtering during runtime, the kernel prepares filtered interface definitions in advance, reducing the complexity of runtime security management while maintaining reduced attack surface.
Solution Approach 2:
The patent introduces ABIs as intermediary layers between user space programs and the kernel system call interface. These ABIs act as mediators that translate program requests into appropriate system calls, providing a simplified interface that reduces complexity by abstracting away the full system call space from individual programs.
3Ease of operation
If conventional system call filtering is used activated by user space programs, then ease of operation is improved, but effectiveness against malicious code decreases
Solution Approach 1:
The kernel activates and configures the appropriate ABI before executing user space programs, rather than relying on programs to activate their own filters. This preliminary action by the kernel ensures security filtering is in place before any malicious code can execute, making the approach effective against malicious programs while remaining easy to operate.
Solution Approach 2:
The kernel automatically selects and applies the appropriate ABI based on the program type without requiring manual configuration or activation by users. The system serves itself by autonomously determining which ABI should be used for each program category, maintaining ease of operation while ensuring reliable security effectiveness.
Data Source
AI summary
Systems and methods for restricting application binary interfaces. An example method may comprise: initializing, by a process spawned by a kernel of an operating system running on a computer system, a system call filter inhibiting at least one type of application binary interface (ABI) calls; receiving a system call issued by a user space program executed by the computer system; intercepting the system call by the system call filter; determining that the system call is disabled by the system call filter; and performing a pre-determined action with respect to the system call.