Go With the Flow: Enforcing Program Behavior Through Syscall Sequences and Origins

Overview: Claudio Canella from Graz University of Technology presents Go With the Flow, introducing Syscall Flow Integrity Protection (SFIP) and its proof-of-concept implementation, SysFlow. Addressing the continuous rise in published CVEs and the practical limitations of bug elimination, the research focuses on restricting post-exploitation capabilities. By combining principles from Control Flow Integrity (CFI) and Linux seccomp, SysFlow enforces valid syscall sequences and instruction origins at the kernel boundary to prevent exploit payloads and return-oriented programming (ROP) chains from interacting with the operating system.

Key Topics: - Post-exploitation mitigation limitations in traditional CFI and Linux seccomp - Concept of Syscall Flow Integrity Protection (SFIP) - Static extraction of Inter-procedural Control Flow Graphs (ICFG) and syscall origins - SysFlow architecture: modified LLVM toolchain, support library, and Linux kernel enforcement

Technical Details: Traditional exploitation defenses exhibit architectural boundaries that adversaries routinely exploit. While Control Flow Integrity (CFI) statically models application control flow graphs to restrict branch targets, it typically operates within a single security domain (either user space or kernel space) and fails to govern cross-domain operating system transitions. Conversely, Linux Secure Computing Mode (seccomp) filters individual system calls at the kernel interface but evaluates calls in complete isolation—lacking historical execution context—and imposes significant configuration complexity on developers attempting to manually map permissible syscalls for complex server applications.

To resolve these limitations, Canella introduces Syscall Flow Integrity Protection (SFIP), built upon three structural pillars: syscall sequence verification, syscall origin validation, and kernel-level policy enforcement. During compilation, static analysis extracts valid syscall sequence transitions of length two (2-grams) across the application, generating a state machine that permits a syscall only if it follows a legitimate preceding system call according to the program's Inter-procedural Control Flow Graph (ICFG). Simultaneously, the framework extracts the exact instruction origin of every syscall instruction (syscall/sysenter), generating an origin-to-syscall mapping (1:1 or 1:N). This prevents hijacked control flows or ROP chains from invoking arbitrary syscalls from unauthorized call sites in executable memory.

The authors implemented SFIP in an end-to-end framework named SysFlow consisting of three components: a modified LLVM compiler toolchain, a user space runtime support library, and a modified Linux kernel. The LLVM compiler analyzes C and assembly source files, generates the ICFG across call targets, and extracts valid syscall sequence pairs and call-site origins. The support library calculates runtime binary offsets and registers the enforcement rules with the operating system upon initialization. At runtime, the modified Linux kernel intercepts each dispatched system call, verifying both that the calling program counter corresponds to an authorized origin and that the current syscall represents a valid state transition relative to the previous invocation before allowing execution.

Key Takeaways: Limiting post-exploitation interaction with the kernel requires contextual enforcement that validates both call sequences and call-site origins rather than checking stateless syscall whitelists. Compiler toolchains can automatically extract inter-procedural call graphs to generate application-specific syscall policies without imposing burdensome manual rule configuration on developers. Kernel security architectures should incorporate execution history and origin tracking (via kernel patches or eBPF) to neutralize ROP chains attempting unauthorized OS interactions.

(AI summary — Gemini Flash)