Preventing Unintended Data Access: Information Flow Control in eBPF

Abstract

We: 1) Identify the balance between allowing access to sensitive data and preventing leakages in kernel extensions. 2) Design techniques to assign sensitivity labels and policies to inputs/outputs of kernel extensions, propagating them during execution. 3) Implement a system that distinguishes between safe and malicious kernel extensions that access sensitive data.