Enforcement of In-Kernel Stateful Security Policies via eBPF

BPFence: A Runtime-Verification Framework for History-Dependent Attacks in Multi-Tenant Systems

Letterio Galletta· 2026· DOI 10.48550/arXiv.2609.13930

The core problem

Many attacks against workloads running on multi-tenant systems are multi-step and history-dependent: sequences of innocuous operations whose malicious nature emerges only over an execution trace. Defending against them requires security policies that are stateful, are enforced within the kernel, and have a precise semantics. Currently deployed proposals fail on at least one count: the kernel's built-in syscall filtering and classical MAC frameworks are stateless, while current eBPF-based tools express their policies through ad hoc YAML rules that cannot capture temporal relations among events, and whose semantics is defined only by the implementation. This paper presents BPFence, an in-kernel runtime-verification framework that satisfies the properties above. The work is motivated by the gap between the expressiveness needed to describe multi-step attacks and the enforcement mechanisms available in production kernels. BPFence provides a policy language with a formal semantics that can express temporal relations among events, and a type system that statically distinguishes events the kernel can control from those it can only observe. The central claim is that stateful, in-kernel, se

The evaluation of BPFence is conducted on seven case studies drawn from real-world attack patterns, and on a set of micro- and macro-benchmarks. The case studies demonstrate that the policy language can express the temporal relations required to detect multi-step, history-dependent attacks that stateless mechanisms cannot capture. The benchmarks show that the enforcement overhead remains compatible with production deployment. The paper reports that every well-typed policy is compiled into a finite-state monitor proved correct with respect to its semantics, and then into eBPF programs that run inside the kernel. The type system statically distinguishes events the kernel can control from those it can only observe, which is essential for sound enforcement. The results support the claim that stateful, in-kernel, semantically precise enforcement is feasible without prohibitive cost. The seven case studies are drawn from real-world attack patterns, providing evidence of practical relevance. The micro- and macro-benchmarks quantify the overhead, and the authors conclude it remains compatible with production deployment.

Many attacks against workloads running on multi-tenant systems are multi-step and history-dependent: sequences of innocuous operations whose malicious nature emerges only over an execution trace. Defending against them requires security policies that are stateful, are enforced within the kernel, and have a precise semantics. Currently deployed proposals fail on at least one count: the kernel's built-in syscall filtering and classical MAC frameworks are stateless, while current eBPF-based tools express their policies through ad hoc YAML rules that cannot capture temporal relations among events, and whose semantics is defined only by the implementation. This paper presents BPFence, an in-kernel runtime-verification framework that satisfies the properties above. The work is motivated by the gap between the expressiveness needed to describe multi-step attacks and the enforcement mechanisms available in production kernels. BPFence provides a policy language with a formal semantics that can express temporal relations among events, and a type system that statically distinguishes events the kernel can control from those it can only observe. The central claim is that stateful, in-kernel, semantically precise enforcement is achievable with overhead compatible with production deployment.

BPFence is structured as a compilation pipeline from a high-level policy language to in-kernel eBPF programs. The policy language has a formal semantics that captures temporal relations among events. A type system statically distinguishes events the kernel can control from those it can only observe, ensuring that enforcement actions are only attached to controllable events. Every well-typed policy is compiled into a finite-state monitor that is proved correct with respect to its semantics, and then into eBPF programs that run inside the kernel. Formally, a policy P is well-typed under context Γ, written Γ ⊢ P : τ, where τ classifies events as controllable or observable. The compilation is a sequence of semantics-preserving transformations:

The analysis centers on the three requirements for defending against multi-step, history-dependent attacks: statefulness, in-kernel enforcement, and precise semantics. BPFence satisfies all three, whereas currently deployed proposals fail on at least one count. Kernel's built-in syscall filtering and classical MAC frameworks are stateless, while current eBPF-based tools express their policies through ad hoc YAML rules that cannot capture temporal relations among events, and whose semantics is defined only by the implementation. BPFence addresses these limitations with a policy language with formal semantics, a type system that statically distinguishes controllable from observable events, and a compilation to finite-state monitors proved correct with respect to the semantics. The correctness proof is central: it ensures that the eBPF programs enforce exactly the policies expressed in the language. The type system prevents attaching enforcement actions to events the kernel can only observe, which would be unsound. The evaluation on seven case studies and benchmarks indicates that the overhead is compatible with production deployment. The discussion implies that formal, stateful, in-kernel enforcement is a viable direction for securing multi-tenant systems against advanced attacks. Future work may extend the policy language or optimize the compilation further.

CS practitioners and researchers

Opening member content…