Flexible and Secure Process Confinement with eBPF

To avoid potential bugs and vulnerabilities, it is crucial to confine process execution within well-defined boundaries, specifying which resources are accessible and what operations are allowed. Numerous technologies have emerged in Linux environments to address process confinement or isolation. However, these solutions often lacked tailored support, leading to a fragmented landscape of complex implementations. Given the need to support different security abstractions, the Extended Berkeley Packet Filter (eBPF) has emerged as a promising technology for extending the capabilities of the Linux kernel functionalities, offering a simple and flexible approach for process confinement. This paper introduces a framework that leverages eBPF to achieve flexible and secure process confinement. We developed a prototype implementation and evaluated its overhead in limiting filesystem capabilities. Experimental findings underscore the effectiveness of our framework, demonstrating that it can seamlessly integrate into Linux systems without incurring remarkable overhead.