Evaluating the Effect of Improved Indirect Call Resolution on System Call Debloating

Applications use only a small set of the system calls made available by the operating system. Modifying programs to debloat or disallow unused system calls is a mitigation technique that can both reduce kernel attack surface and attacker capabilities for when an application gets compromised. To achieve this, existing systems generate a sound function call graph of the application and its dependent libraries and based on that, determine the minimum set of system calls used. Techniques that refine the call graph by determining the possible targets of indirect function calls have, in theory, the potential to also improve system-call debloating. In this paper, we evaluate the effects of state-of-the-art indirect calls refinement technique and we find that even though it improves the application call graph, it does not have any significant effect on system call policies. In contrast, we find that standard C library (libc) being used plays a more important role on restricting system calls. Context-sensitive and path-sensitive call graph refinement on libc could bring benefits to system call debloating.