.png){kind=icon}
返回
Shrinking the Kernel Attack Surface Through Static and Dynamic Syscall Limitation
.png){kind=icon}
PRE
AI
DOI：10.1109/TSC.2022.3173791.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Linux Seccomp is widely used by the program developers and the system maintainers to secure the operating systems, which can block unused syscalls for different applications and containers to shrink the attack surface of the operating systems. However, it is difficult to configure the whitelist of a container or application without the help of program developers. Docker containers block about only 50 syscalls by default, and lots of unblocked useless syscalls introduce a big kernel attack surface. To obtain the dependent syscalls, dynamic tracking is a straight-forward approach but it cannot get the full syscall list. Static analysis can construct an over-approximated syscall list, but the list contains many false positives. In this paper, a systematic dependent syscall analysis approach, sysverify, is proposed by combining static analysis and dynamic verification together to shrink the kernel attack surface. The semantic gap between the binary executables and syscalls is bridged by analyzing the binary and the source code, which builds the mapping between the library APIs and syscalls systematically. To further reduce the attack surface at best effort, we propose a dynamic verification approach to intercept and analyze the security of the invocations of indirect-call-related or rarely invoked syscalls with low overhead.
Keyword:
Terms-Container security
dependent syscall analysis
dynamic verification
shrinking attack surface
systematic static analysis
期刊
IF:
5.8
论文数:
2.2K
被引数:
6.5K
机构
引用论文
Visual Responses in FEF, Unlike V1, Primarily Reflect When the Visual Context Renders a Receptive Field Salient与V1不同，FEF中的视觉反应主要反映了视觉环境何时使感受野显着
OAAI
OAAI分享收藏分享收藏Trifurcula (Glaucolepis) lituanica sp. nov., an unexpected new stem-miner on Salvia pratensis occurring in eastern Europe (Lepidoptera: Nepticulidae)Trifurcula (Glaucolepis) lituanica sp. nov.，一种在东欧出现的Salvia pratensis新茎蛀虫（鳞翅目：Nepticulidae）。.png)
ZootaxaOAAI
ZootaxaIF0
OAAI分享收藏Correlation of atomic force microscopy sidewall roughness measurements with scanning electron microscopy line-edge roughness measurements on chemically amplified resists exposed by x-ray lithography化学放大抗蚀剂经X射线光刻曝光后，原子力显微镜侧壁粗糙度测量与扫描电子显微镜线边缘粗糙度测量的相关性
PREAI
分享收藏分享收藏分享收藏
查看更多内容