Automated Policy Synthesis for System Call Sandboxing
summary
Abhaya automatically generates sound, optimal syscall-whitelisting policies by combining a scalable static analysis with an SMT-guided synthesis phase. The static analysis uses a reduced product of array expansion and disjunctive interval domains to produce syscall invariants; synthesis enumerates sketches and uses CEGIS-like blocking clauses. Evaluated on 674 apps (491 seccomp / 183 pledge), it blocks all recorded Linux privilege-escalation exploits for over 90% of apps, matches developer pledge policies exactly for ~60% (avg F1 ≈ 0.9), and runs in about 7.3 min analysis + 2.3 min synthesis per app.
AI-written summary · about
chapters (18)
- 0:00Intro
- 0:31Syscall Whitelisting
- 1:09Attack Scenario
- 3:34Policy Synthesis with Abhaya
- 4:07Workflow
- 4:47Why overapproximate?
- 5:47Motivating Example
- 7:57Syscall Analysis
- 10:06Compute Syscall Invariant
- 11:12Why optimal synthesis?
- 12:43Highlights of Synthesis Algorithm
- 13:58Evaluation: Research Questions
- 14:13Evaluation: Setup
- 14:37Evaluation: Block Real World Exploits
- 15:23Comparison against Manually written policies
- 16:06How Efficient is Abhaya
- 16:34Conclusion
- 16:55Questions?
related talks
19mBuilding Dynamic System Call Sandbox with Partial Order Analysis
11mPlaying in the Sandbox: A Study on the Usability of Seccomp
38mSandboxing in Linux with zero lines of code
33mOpen & Secure: Novel Sandboxing Technique for Any Open Source Library
44mSeccomp for Developers - Making Applications Simply More Secure
31mAutomatic application hardening by leveraging container runtime behavior analysis
26mSyscall Me by Your Name: Sandboxing Wasm Programs
35mEnter Sandbox