SysComb Enforces State-Aware Syscall Filters via eBPF With No Kernel or Application Changes

arXiv 2608.26871·medium signalXBlueskyLinkedInCopy link

Every prior temporally-specialized system call filtering approach requires modifying either the kernel or the application to activate filters at runtime, which is impractical when the code is maintained by a third party. SysComb uses eBPF to enforce filters keyed to application state without touching either, and lets the developer pick between a seccomp-like strategy that guarantees no new privileges after a state transition and a least-privilege strategy that applies the most restrictive filter per state. Evaluation on widely used software showed accurate state-aware filtering with overhead comparable to built-in kernel mechanisms, which makes attack-surface reduction viable for sandboxing agent-executed processes you do not control.