4 ms·
Not sure how to do that from OS perspective without introducing some kind of module concept (either through shared object or some other ways). The SAPI solutio
by liuliu 5y ago
Not sure how to do that from OS perspective without introducing some kind of module concept (either through shared object or some other ways).
The SAPI solution seems pretty straightforward to me. Jail the particular library into a sandboxed process and IPC with it transparently. Compatibility will be tricky (especially for libraries that is more complicated). But the solution itself is straightforward and I can see it work.
- a-dub 5y agoyup. we need an operating system and hardware that sandboxes all code and state that runs on it by source, yet still has fast interfaces between units and avoids overt complexity by bolting facilities for this on top.
- Findecanor 5y agoCheck out ELFbac: (http://elfbac.org/ http://elfbac.org/) It extracts "programmer intent" from relations in the ELF format to create memory protection boundaries. It is not exactly sandboxing, but limits what a compromised program module can do.