Userspace programs depend heavily on operating system resources to execute correctly, with file access being one of the most common and critical use cases. Modern Linux distributions include a vast number of files, many of which are unnecessary for the operation of most programs. However, existing access control mechanisms typically enforce coarse-grained policies that allow programs to access far more files than they actually require. This over-permissiveness significantly increases the system’s attack surface, exposing sensitive resources to potential exploitation.In this paper, we introduce AMPLE (Automated MAC PoLicy Extraction), a versatile tool that integrates both static and dynamic analysis to identify the files required by server applications. Ample accomplishes this by leveraging the distinct phases of server application execution, extracting runtime-dependent file paths by executing only the program’s initialization phase. This novel approach addresses the limitations of relying exclusively on static analysis, which fails to identify runtime-dependent file paths, as well as the shortcomings of purely dynamic analysis, which overlooks file paths accessed in non-executed code paths. To demonstrate its effectiveness, we evaluated Ample on ten widely-used server applications. The results show that Ample significantly reduces the number of accessible files, achieving an average reduction of over 99%, and limiting access to an average of fewer than 254 files per application. This substantial reduction helps restrict access to numerous security-critical files and mitigates 13 Linux kernel CVEs.

Program termination is a classic non-safety property whose falsification cannot in general be witnessed by a finite trace. This makes testing for non-termination challenging, and also a natural target for symbolic proof. Several works in the literature apply non-termination proving to small, self-contained benchmarks, but it has not been developed for large, real-world projects; as such, despite its allure, non-termination proving has had limited practical impact. We develop a compositional theory for non-termination proving, paving the way for its scalable application to large codebases. Discovering non-termination is an under-approximate problem, and we present UNT er , a sound and complete under-approximate logic for proving non-termination. We then extend UNT er with separation logic and develop UNTer SL for heap-manipulating programs, yielding a compositional proof method amenable to automation via under-approximation and bi-abduction. We extend the Pulse analyser from Meta and develop Pulse ∞ , an automated, compositional prover for non-termination based onx UNTer SL . We have run Pulse ∞ on large codebases and libraries, each comprising hundreds of thousands of lines of code, including OpenSSL, libxml2, libxpm and CryptoPP; we discovered several previously-unknown non-termination bugs and have reported them to developers of these libraries.

This paper describes our experience of performing reactive security audit of known security vulnerabilities in core operating system and browser COM components, using an extended static checker HAVOCLITE. We describe the extensions made to the tool to be applicable on such large C++ components, along with our experience of using an extended static checker in the large. We argue that the use of such checkers as a configurable static analysis in the hands of security auditors can be an effective tool for finding variations of known vulnerabilities. The effort has led to finding and fixing around 70 previously unknown security vulnerabilities in over 10 millions lines operating system and browser code.