Contemporary operating systems, such as Linux, have grown to be large, complex pieces of software. They are meant to support a large number of applications and hardware devices. Yet, typical applications may only use a fraction of the code in such operating systems. With increased code comes increased attack surfaces – particularly if the code paths are not stressed/explored often enough. Combined with the increased use of container-type systems, a security vulnerability that is exploited by any one application could result in the failure of either the entire operating system or even other applications running on the same platform.

In this talk I present two methods for “code debloating”, i.e. automatic code reduction, for commodity operating systems, especially Linux. COZART, uses compile-time configuration options, while MULTI-K uses more aggressive tracing-based methods combined with masking of OS code to orchestrate multiple specialized (reduced) kernels. Both of these operate in a manner that’s transparent to the end user/application developers. We see significant savings in OS code usage, better boot times and performance and also improved security and resiliency guarantees.