Unleashing Unprivileged eBPF Potential with Dynamic Sandboxing
Unleashing Unprivileged eBPF Potential with Dynamic Sandboxing
复制标题
DOI：
10.1145/3609021.3609301
复制
发表时间：
2023-08
期刊：
影响因子：
--
通讯作者：
S. Lim;Xueyuan Han;Thomas Pasquier
中科院分区：
文献类型：
--
作者：
S. Lim;Xueyuan Han;Thomas Pasquier
出于安全原因，今天的非特权用户只能通过扩展的Berkeley Packet Filter（eBPF）来定制内核。这是不幸的，特别是因为eBPF框架本身在过去几年中范围不断扩大。我们提出了SandBPF，一个基于软件的内核隔离技术，动态沙箱eBPF程序，允许非特权用户安全地扩展内核，释放eBPF的全部潜力。我们早期的概念验证表明，SandBPF可以有效地防止eBPF的本地安全机制（即，静态验证），同时在Web服务器基准测试上产生0%-10%的开销。
For safety reasons, unprivileged users today have only limited ways to customize the kernel through the extended Berkeley Packet Filter (eBPF). This is unfortunate, especially since the eBPF framework itself has seen an increase in scope over the years. We propose SandBPF, a software-based kernel isolation technique that dynamically sandboxes eBPF programs to allow unprivileged users to safely extend the kernel, unleashing eBPF's full potential. Our early proof-of-concept shows that SandBPF can effectively prevent exploits missed by eBPF's native safety mechanism (i.e., static verification) while incurring 0%-10% overhead on web server benchmarks.