NOR flash has been increasingly popular for RAM-restricted microcontrollers due to its small package, high reliability, etc. To satisfy RAM restrictions, existing NOR flash file systems migrate their functionalities, i.e., block-level data organization and wear leveling (WL), from RAM to NOR flash. However, such fine-grained block-level management introduces frequent index updates and NOR flash scanning, leading to severe I/O amplification, which further deteriorates as they are decoupled in existing NOR flash file systems.

The rapid development of Function as a Service (FaaS) has introduced emerging security demands for untrusted functions. Specifically, they necessitate large-scale, fine-grained, high-performance isolation. eBPF offers a promising mechanism for fine-grained isolation in process granularity. However, it suffers from inherent programming constraints (e.g., limitations on instruction count, stack size, and loop). Thus, existing eBPFbased storage isolation (sandbox) requires manual and restricted development of per-function eBPF programs, which hinders practical deployment in FaaS at scale. To address this, we present an eBPF-based file access control (eFAC) architecture atop storage isolation for the first time, with the key idea to decouple the sandbox into a file ACL model and rules. We redesign the eBPF software stack and extract a minimal, uniformly optimized, and transparent file ACL model in an eBPF program to handle the core logic of file access control. We revive eBPF-based storage isolation in FaaS by integrating eFAC into an open-source FaaS platform. Extensive evaluation shows that eFAC enables fast function deployment at scale via simple ACL rules, achieves near-native performance under I/O-intensive workloads, and reduces resource overhead and latency compared to container-based FaaS with lightweight storage isolation.