GoLeash: Mitigating Golang Software Supply Chain Attacks with Runtime Policy Enforcement

The gist GoLeash is a novel system that applies runtime policy enforcement at the package-level granularity to mitigate software supply chain attacks in Go. This fine-grained approach enables precise detection of malicious packages, even under obfuscation, while maintaining acceptable runtime overhead.

Introduction and Motivation

Software supply chain attacks are increasingly targeting the Go language ecosystem because it is extensively used in critical cloud infrastructures like Kubernetes and Docker These attacks involve injecting harmful code into trusted third-party software components to propagate through dependency chains The paper aims to improve the state of the art of mitigating software supply chain attacks on Golang critical applications GoLeash is inspired by the “principle of least privilege,” enforcing distinct security policies for each package in the supply chain

GoLeash Architecture and Mechanism

GoLeash operates with two modes: an analysis mode to automatically infer policies and an enforcement mode that restricts behavior at run-time The architecture consists of a kernel-space tracing component and a userspace analysis engine The workflow involves inserting tracing probes in the kernel to capture system call (syscall) events, which are then collected in user space for stack trace resolution GoLeash maps the stack trace to the originating Go packages and classifies the syscall into a capability

Dependency Attribution and Policy Generation

After capturing system call events, GoLeash attributes each syscall to the specific Go package responsible for triggering it This is achieved by resolving the stack trace into a full stack trace and mapping return addresses to Go package import paths The system scans the full trace to find the first frame originating from an application-defined or third-party package function, ensuring it does not misattribute behavior to trusted components In analysis mode, GoLeash aggregates this information to build a capabilities allowlist for each package

Capability Mapping and Enforcement

GoLeash defines a capability taxonomy that maps low-level syscalls to semantically meaningful categories, such as CAP FILE and CAP CONNECT REMOTE In enforcement mode, GoLeash checks each syscall in real-time against the policy, validating both the origin of the syscall and the capability being exercised Enforcement is context-aware because it validates not only the invoking package but also the full call path in the stack trace to defend against confused deputy attacks

Experimental Evaluation

The evaluation involved injecting malicious behaviors into real-world, complex Go projects like Kubernetes and etcd The detection rate for GoLeash was 98% across all tested projects, significantly higher than the 32% detection rate of the coarse-grained process-level baseline GoLeash remained effective even when obfuscation techniques were used for hiding malicious code, achieving average detection rates ranging from 92.09% to 100% for malware M2 and M5

Performance and Comparison

GoLeash introduces an average system call latency of 3.17 ms and an average overhead of 9.34% in execution time during enforcement mode This overhead is considered acceptable for the security benefits provided When compared to the static capability analysis tool Capslock, GoLeash consistently and significantly outperforms Capslock across all five projects and obfuscation techniques This performance gap stems from GoLeash's fine-grained granularity versus Capslock's coarser level of granularity

Conclusion

GoLeash provides a foundation for hardening the runtime security of modern software by enforcing runtime least-privilege boundaries at the level of individual Go packages It achieves high detection accuracy, remains effective under obfuscation, and incurs acceptable overhead. The approach is conceptual and portable to other languages and systems like Java and Rust.

--- Page 8 ---

GoLeash is a novel approach for policy enforcement. Existing approaches for monitoring and sandboxing of system calls for Go [38, 69] only apply to entire processes and containers, which makes enforcement too coarse-grained to mitigate supply chain attacks If a package in the program is allowed to use a capability (e.g., a privileged system call), the entire process or container needs to be assigned that capability GoLeash works at a finer grain, since it is able to trace back which Go package is using a capability at a given moment, thus it can enforce separate policies across different Go packages

--- Page 9 ---

GoLeash defines a capability taxonomy (Table 1) that maps low-level syscalls to semantically meaningful categories For instance, filesystem-related syscalls are split into read and write capabilities, allowing developers to grant read access without permitting file modifications This granularity enables expressive yet narrowly scoped policies, significantly reducing the risk of unintended or malicious behavior

--- Page 9 ---

The construction of allowlists is designed to be iterative and non-disruptive As new functionality is added to the application, GoLeash can be rerun to observe and record additional capability and call paths, and incorporate them into the existing policy Developers can manually audit the allowlist and append entries when necessary, such as when preparing for production deployment after a review of expected system behavior

--- Page 9 ---

For every intercepted syscall, GoLeash resolves its associated capability and identifies the terminal package responsible, using the same attribution and classification logic from analysis The syscall is then validated against the policy: if the (package, capability) pair is present, and the corresponding call path matches one of the approved sequences stored for that capability, the syscall is allowed to proceed uninterrupted

--- Page 9 ---

GoLeash supports multiple enforcement strategies, allowing it to be used for forensics and response purposes In forensics use cases, violations are logged for postmortem analysis, enabling developers to assess suspicious behaviors without disrupting application functionality

--- Page 9 ---

GoLeash distinguishes between system calls originating from the Go runtime from those issued by packages of the application and modules If the entire call stack contains only frames from Go’s runtime and does not include any package of the application or modules, the system call is treated as coming from trusted infrastructure and excluded from enforcement

--- Page 9 ---

GoLeash handles runtime behaviors that complicate syscall attribution in Go, such as process forking and multi-binary applications Supporting these behaviors is essential, as they are common in modern Go systems

--- Page 9 ---

GoLeash relies on Go symbol tables to map system calls to their originating packages via stack traces This works reliably because Go binaries are typically not stripped in production environments

--- Page 9 ---

GoLeash is designed for the Go language on Linux, leveraging eBPF tracing and Gospecific features (e.g., package management, symbol tables) However, its core design principles (e.g.

1. Bold header: Fine-grained runtime capability enforcement across Go packages. This allows GoLeash to enforce least-privilege boundaries across dependencies, as opposed to coarse-grain process-based privileges by tracing and enforcing distinct security policies for each package in the supply chain.

2. Bold header: Detection of malicious code under obfuscation. GoLeash is shown to be robust against evasion, with detection rates remaining high even when malicious code is hidden using techniques like CGO or reflection, as it still identifies unauthorized behavior that falls outside a package’s generated policy.

3. Bold header: Superior detection over static analysis. GoLeash consistently outperforms Capslock, as the paper notes that GoLeash’s dynamic analysis outperforms Capslock’s static analysis because it can capture behavior that is exercised during runtime which static tools often miss due to coarser granularity.

4. Bold header: Accurate dependency attribution for system calls. The system resolves stack traces to attribute syscalls precisely, ensuring GoLeash does not assign the syscall to the topmost stack frame, correctly identifying the package responsible, such as attributing a write syscall to the frame of third-party package fatedier/frp/server.

5. Bold header: Context-aware enforcement against confused deputy attacks. GoLeash defends against indirect privilege escalation by validating both origin and context, ensuring that even if the terminal package is authorized for a capability, the unapproved calling context causes the request to be denied.

Modern software supply chain attacks consist of introducing new, malicious capabilities into trusted third-party software components, in order to propagate to a victim through a package dependency chain. These attacks are especially concerning for the Go language ecosystem, which is extensively used in critical cloud infrastructures. We present GoLeash, a novel system that applies the principle of least privilege at the package-level granularity, by enforcing distinct security policies for each package in the supply chain. This finer granularity enables GoLeash to detect malicious packages more precisely than traditional sandboxing that handles security policies at process- or container-level. Moreover, GoLeash remains effective under obfuscation, can overcome the limitations of static analysis, and incurs acceptable runtime overhead.