SysComb: Fine-Grained Transparent System Call Filtering for Attack Surface Reduction

2026-08-27

AI Summary

本文提出SysComb，一种基于eBPF的技术，无需修改应用或内核代码即可实现细粒度系统调用过滤，减少攻击面。

Abstract

Restricting the system calls available to applications shrinks the kernel's attack surface and greatly mitigates the impact of compromised programs. Recent approaches showcase techniques to generate system call filters, however, all existing solutions require either kernel or application modifications to activate them at runtime. This is intrusive, error-prone, and often impractical, especially when the code is maintained by external parties. This paper presents SysComb, a novel eBPF-based solution to enforce temporally-specialized system call filters based on the application state, without requiring any modification to the application or the kernel code, and thus addressing the above limitations. Moreover, SysComb lets the developer choose between two distinct enforcement strategies: seccomp-like, ensuring no new privileges are gained after a state transition is performed, and least-privilege, which applies to each state the most restrictive filter. We evaluated SysComb using widely used software, showcasing accurate state-aware system call filtering and an overhead comparable to built-in kernel solutions, demonstrating the practicality of our approach.

Problem

• system call filtering
• attack surface reduction
• application state
• non-intrusive

Innovation

• eBPF
• state-aware system call filtering
• non-intrusive
• least-privilege
• seccomp-like