The Linux kernel makes considerable use of Berkeley Packet Filter (BPF) to allow user-written BPF applications to execute in the kernel space. BPF employs a verifier to statically check the security of user-supplied BPF code. Recent attacks show that BPF programs can evade security checks and gain unauthorized access to kernel memory, indicating that the verification process is not flawless. In this paper, we present MOAT, a system that isolates potentially malicious BPF programs using Intel Memory Protection Keys (MPK). Enforcing BPF program isolation with MPK is not straightforward; MOAT is carefully designed to alleviate technical obstacles, such as limited hardware keys and supporting a wide variety of kernel BPF helper functions. We have implemented MOAT in a prototype kernel module, and our evaluation shows that MOAT delivers low-cost isolation of BPF programs under various real-world usage scenarios, such as the isolation of a packet-forwarding BPF program for the memcached database with an average throughput loss of 6%.

翻译：Linux内核广泛使用伯克利数据包过滤器（BPF），允许用户编写的BPF应用程序在内核空间中执行。BPF通过一个验证器静态检查用户提供的BPF代码的安全性。最近的攻击表明，BPF程序能够绕过安全检查并获得对内核内存的未授权访问，这表明验证过程并非完美无缺。在本文中，我们提出MOAT，一个使用英特尔内存保护密钥（MPK）隔离潜在恶意BPF程序的系统。利用MPK强制执行BPF程序隔离并非易事；MOAT经过精心设计，以缓解技术障碍，例如有限的硬件密钥和支持广泛的内核BPF辅助函数。我们在一个原型内核模块中实现了MOAT，评估表明，在各种实际使用场景下，MOAT能够以低成本实现BPF程序的隔离，例如为memcached数据库隔离一个数据包转发BPF程序，平均吞吐量损失为6%。