Abstract: The setuid mechanism in Linux enables users to temporarily escalate the privileges of programs.Such a mechanism violates the principle of least privilege.Once vulnerabilities exist in these programs,attackers can exploit the privileges to conduct privilege escalation,resulting in severe consequences.To address this issue,the capability mechanism in Linux decomposes the root privilege into a set of fine-grained capabilities and assigns only the required capability to the program,thereby mitigating risks.Existing capability-limiting approaches based on system-call identification have exhibited drawbacks when obtaining the genuine capability subset required by the program.On one hand,due to the failure to filter out redundant code in dynamic libraries and the inaccurate analysis of the Glibc call graph,the resulting system-call set is over-approximated.On the other hand,the inaccurate system-call parameter analysis leads to a conservative estimation of capabilities for the system calls.This paper presents a program capability-limiting framework based on code specialization.The program-dependent dynamic libraries are pruned to reduce the impact of redundant library code on the system-call identification.Combined with the dynamic library pruning results,this work analyzes the system calls on the pruned Glibc call graph and obtains a more precise set of system calls specific to the program.Moreover,this work conducts iterative backward data-flow analysis on the pruned program-specific dynamic libraries to extract sensitive parameter values for specific system calls.Based on the program-specific system call set and the sensitive para-meter values,the accurate capability set required by the program is identified.For a specific binary program,the proposed framework conducts the analysis and restricts the program with the accurate capability set and system-call set,thereby reducing the privileged operations that the program can perform.Experimental results demonstrate that,compared to state-of-the-art approaches,the proposed approach identifies system calls more accurately and enforces stronger capability restrictions on the program.On setuid programs,this work can significantly reduce the attack surface and alleviate privilege-escalation vulnerabilities.

Key words: Privilege, System call, Linux capability, Program analysis, Data-flow analysis, Parameter analysis