[Paper Review] Debloating Software through Piece-Wise Compilation and Loading

Anh Quach, Aravind Prakash+1 more|arXiv (Cornell University)|Feb 2, 2018

Security and Verification in Computing30 citations

TL;DR

This paper presents a compiler-based debloating framework that enables piece-wise compilation and loading of software components, reducing code bloat by up to 86% in benchmark programs and over 79% in coreutils without functional regression. The approach eliminates unused code—including vulnerable and reusable gadget code—while incurring minimal load-time overhead, demonstrating significant security and performance benefits across real-world applications like Firefox and curl.

ABSTRACT

Programs are bloated. Our study shows that only 5% of libc is used on average across the Ubuntu Desktop environment (2016 programs); the heaviest user, vlc media player, only needed 18%. In this paper: (1) We present a debloating framework built on a compiler toolchain that can successfully debloat programs (shared/static libraries and executables). Our solution can successfully compile and load most libraries on Ubuntu Desktop 16.04. (2) We demonstrate the elimination of over 79% of code from coreutils and 86% of code from SPEC CPU 2006 benchmark programs without affecting functionality. We show that even complex programs such as Firefox and curl can be debloated without a need to recompile. (3) We demonstrate the security impact of debloating by eliminating over 71% of reusable code gadgets from the coreutils suite and show that unused code that contains real-world vulnerabilities can also be successfully eliminated without adverse effects on the program. (4) We incur a low load time overhead.

Motivation & Objective

• To address the pervasive problem of software bloat, where only a small fraction of code in libraries is actually used in practice.
• To design and implement a compiler toolchain that enables selective compilation and runtime loading of program components to eliminate unused code.
• To evaluate the functional correctness, performance overhead, and security impact of debloating real-world applications and system libraries.
• To demonstrate that debloating can be applied to complex programs like Firefox and curl without recompilation, preserving functionality.
• To quantify the reduction in attack surface by eliminating unused code containing real-world vulnerabilities.

Proposed method

• Leverage a modified compiler toolchain to analyze and extract only the necessary code segments from libraries and executables.
• Implement piece-wise compilation and loading, allowing only required functions and data to be loaded at runtime.
• Use static and dynamic analysis to identify used and unused code paths across diverse programs in the Ubuntu Desktop 16.04 environment.
• Apply binary instrumentation and runtime loading mechanisms to load only the required code segments on demand.
• Integrate with existing build systems and runtime environments to ensure backward compatibility and minimal disruption.
• Validate functionality through extensive testing on coreutils, SPEC CPU 2006 benchmarks, and production applications like Firefox and curl.

Experimental results

Research questions

• RQ1 To what extent can unused code be safely removed from real-world programs without breaking functionality?
• RQ2 How effective is piece-wise compilation and loading in reducing code size across diverse software workloads?
• RQ3 What is the performance overhead introduced by the runtime loading mechanism?
• RQ4 To what degree does debloating reduce the number of code reuse gadgets and known vulnerabilities?
• RQ5 Can debloating be applied to complex, pre-compiled binaries like Firefox and curl without recompilation?

Key findings

• On average, only 5% of libc is used across 2016 Ubuntu Desktop programs, with the highest usage reaching 18% in vlc media player.
• The framework successfully debloated coreutils by over 79% and SPEC CPU 2006 benchmarks by 86% without functional regression.
• The approach eliminated over 71% of reusable code gadgets in the coreutils suite, reducing potential attack surface.
• Unused code containing real-world vulnerabilities was successfully removed without adverse effects on program behavior.
• The runtime load-time overhead remained low, demonstrating practical feasibility for production deployment.
• The method enabled debloating of complex, pre-compiled binaries such as Firefox and curl without requiring recompilation.