Reviving eBPF-Based Storage Isolation in FaaS via Model-Rule Decoupling

The rapid development of Function as a Service (FaaS) has introduced emerging security demands for untrusted functions. Specifically, they necessitate large-scale, fine-grained, high-performance isolation. eBPF offers a promising mechanism for fine-grained isolation in process granularity. However, it suffers from inherent programming constraints (e.g., limitations on instruction count, stack size, and loop). Thus, existing eBPFbased storage isolation (sandbox) requires manual and restricted development of per-function eBPF programs, which hinders practical deployment in FaaS at scale. To address this, we present an eBPF-based file access control (eFAC) architecture atop storage isolation for the first time, with the key idea to decouple the sandbox into a file ACL model and rules. We redesign the eBPF software stack and extract a minimal, uniformly optimized, and transparent file ACL model in an eBPF program to handle the core logic of file access control. We revive eBPF-based storage isolation in FaaS by integrating eFAC into an open-source FaaS platform. Extensive evaluation shows that eFAC enables fast function deployment at scale via simple ACL rules, achieves near-native performance under I/O-intensive workloads, and reduces resource overhead and latency compared to container-based FaaS with lightweight storage isolation.