5 ms·
I don't think this really is what people might call a sandbox but it can optionally block or allow syscalls happening (in my mind only one aspect of a sandbox)
by roryrjb 7y ago
I don't think this really is what people might call a sandbox but it can optionally block or allow syscalls happening (in my mind only one aspect of a sandbox) and it looks like it's interactive. I think this is great. OpenBSD has had great success with pledge and I have been experimenting with seccomp (via the libseccomp project) with both Node.js bindings and a cli in C for doing a very similar thing as Sandy (although not interactively, which is a nice touch).
- craig 7y agoYeah, "sandbox" is definitely a stretch, but I couldn't think of a similar but descriptive term. I've also found since posting there are definitely some easy to expose security wholes where the syscalls aren't traced in threads and child processes. So there is lots of room for improvement. I'll take a look at the projects you mentioned to see how they've tackled those issues. Thanks!
- saagarjha 7y ago"Sandboxing" and "untrusted code" usually carry security connotations. I'd suggest you advertise this as instrumentation or tracing instead.
- ignoramous 7y agoTake a look at MIT's Mbox: https://news.ycombinator.com/item?id=7214419 https://news.ycombinator.com/item?id=7214419 Firejail is another worthwhile alternative: https://news.ycombinator.com/item?id=12239840 https://news.ycombinator.com/item?id=12239840 I stumbled on Solo5 (runs MirageOS/IncludeOS unikernels on Linux) this past month which looked promising: https://github.com/solo5/solo5 https://github.com/solo5/solo5