Comparing Security in eBPF and WebAssembly

Jules Dejaeghere, Bolaji Gbadamosi, Tobias Pulls, Florentin Rochet

Résultats de recherche: Contribution dans un livre/un catalogue/un rapport/dans les actes d'une conférenceArticle dans les actes d'une conférence/un colloque

327 Téléchargements (Pure)

Résumé

This paper examines the security of eBPF and WebAssembly (Wasm), two technologies that have gained widespread adoption in recent years, despite being designed for very different use cases and environments. While eBPF is a technology primarily used within operating system kernels such as Linux, Wasm is a binary instruction format designed for a stack-based virtual machine with use cases extending beyond the web. Recognizing the growth and expanding ambitions of eBPF, Wasm may provide instructive insights, given its design around securely executing arbitrary untrusted programs in complex and hostile environments such as web browsers and clouds. We analyze the security goals, community evolution, memory models, and execution models of both technologies, and conduct a comparative security assessment, exploring memory safety, control flow integrity, API access, and side-channels. Our results show that eBPF has a history of focusing on performance first and security second, while Wasm puts more emphasis on security at the cost of some runtime overheads. Considering language-based restrictions for eBPF and a security model for API access are fruitful directions for future work.
langue originaleAnglais
titreeBPF 2023 - Proceedings of the ACM SIGCOMM 2023 Workshop on eBPF and Kernel Extensions
Lieu de publicationNew York, NY, USA
EditeurACM Press
Pages35–41
Nombre de pages7
ISBN (Electronique)9798400702938
ISBN (imprimé)9798400702938
Les DOIs
Etat de la publicationPublié - 10 sept. 2023

Série de publications

NomeBPF 2023 - Proceedings of the ACM SIGCOMM 2023 Workshop on eBPF and Kernel Extensions

Empreinte digitale

Examiner les sujets de recherche de « Comparing Security in eBPF and WebAssembly ». Ensemble, ils forment une empreinte digitale unique.

Contient cette citation