3 ms·
Read NAMESPACES(7) The Linux kernel itself has a unified sandboxing API, there are just a lot of clients using different parts of it. And that's pretty nice,
by sascha_sl 7y ago
Read NAMESPACES(7)
The Linux kernel itself has a unified sandboxing API, there are just a lot of clients using different parts of it.
And that's pretty nice, being able to pick what you need when developing an OS conceptually just barely above the kernel.
Cgroups is more of a resource constraining API, I wouldn't call it the exact same concern as sandboxing.
http://man7.org/linux/man-pages/man7/namespaces.7.html http://man7.org/linux/man-pages/man7/namespaces.7.html
- the_duke 7y agoI mentioned namespaces. The point I was trying to make: while you can build sandboxing solutions based on Linux, the entire ecosystem has evolved without sandboxing as a first class concept, leading to numerous half-baked, half-adopted solutions that are all quite cumbersome from a user perspective. A new OS with sandboxing by default would probably produce a applicaton ecosystem that is more secure. Also, isolating many normally privileged facilities (like drivers, file systems, ...) is not something that is reasonable on Linux.
- amluto 7y agoI’ve read that, and I helped develop and troubleshoot it. It’s a rather complex solution to the problem that POSIX is not particularly amenable to sandboxing. A good capability-based design can be sandboxed with no fuss at all.
- heavenlyhash 7y agoIf you read NAMESPACES(7) and thought to yourself "that's a unified API", we have radically different definitions of "unified".