4 ms·
This is all great work, undoubtedly. I do wonder if the app sandboxing story can be improved further, though. For example, I suspect you can further harden the
by jchw 7y ago
This is all great work, undoubtedly. I do wonder if the app sandboxing story can be improved further, though. For example, I suspect you can further harden the defense with a gVisor style approach to sandboxing syscalls and filesystem access, while still using the same kernel mitigations to protect the sandbox itself (if not more). But, I don’t know for sure.
- saagarjha 7y agoThere already seems to be seccomp filters in place.
- jchw 7y agogVisor is a step further: it acts a bit like a user mode kernel, which handles syscalls and carefully passes them to different components that are individually insulated with seccomp, etc. The idea there is that even a root escape gets you nowhere because root in the sandbox can never be root in the host. You’d first need to exploit the “usermode kernel“ then you are an unprivileged Linux user with a very strict security profile depending on what component you have exploited. Exploiting the actual kernel would theoretically be a lot harder because the syscall surface is no longer directly exposed.