6 ms·

How easy is it for a developer to "sandbox" a program?

66 points by zdw 1y ago

ZeroConcerns 1y ago
While interesting, the failure to distinguish between cooperative and unmodified programs here sort-of weakens the comparison. I mean, the OpenBSD APIs are great and all, but most developers are not going to be aware of these, nor deploying to a platform that supports these in the first place. And yes, kernel-mode supervisors, when available, suffer from inscrutable configurations, so it's clear a middle ground would be nice (especially one that also applies to the W-environment), but it's not clear anyone is particularly invested in this?
- ykonstant 1y ago
  Indeed, if you are trying to build something cross-platform and use BSD's specific APIs for security, it is easy to end up with an #ifdef soup in some of the most sensitive parts of your code. One wrong logic step there and you have compromised your application trying to harden it. I don't know the solution :(
- deleted 1y ago
  [deleted]
petermcneeley 1y ago
For obvious reasons chromium has pretty extensive sandboxing. You can read the source right here: https://source.chromium.org/chromium/chromium/src/+/main:content/gpu/gpu_main.cc;l=463?q=gpu_main.cc https://source.chromium.org/chromium/chromium/src/+/main:con...
- simonw 1y ago
  Looks like that's the subset of their sandbox that applies to GPUs, the file is content/gpu/gpu_main.cc
- bqmjjx0kac 1y ago
  Here's a more informative doc about sandboxing in Chromium https://source.chromium.org/chromium/chromium/src/+/main:sandbox/README.md?q=sandbox%20file:md$&ss=chromium%2Fchromium%2Fsrc https://source.chromium.org/chromium/chromium/src/+/main:san...
hdjrudni 1y ago
I'm interested in this for an upcoming project, but complexity of setup doesn't seem like a great way to compare these projects. What I need to know is (a) can I run completely untrusted code in these sandboxes? (b) Which let me disable network access, file system access, and limit CPU and RAM usage? i.e. feature set. The set up might be a pain in the butt, but I'm assuming I only have to do it once and then I can stuff arbitrary programs into it.
simonw 1y ago
The situation on macOS is so frustrating. sandbox-exec / seatbelt has been marked as deprecated for nearly a decade now (since macOS Sierra in 2016) but it's still what everyone uses - here's OpenAI using it for their new Codex CLI: https://github.com/openai/codex/issues/215 https://github.com/openai/codex/issues/215 Maybe the new "containers" stuff in macOS 26 is going to be a good replacement for that? It seems like that's a different solution though. All I want is an easy, documented, supported way to run a binary on my computer and say "it can only access these files, use this much RAM and it's not allowed to make any outbound network requests". It always surprises me how hard this is!
- throwaway290 1y ago
  I use Docker for this. Sandbox is not effective. Like if you run Firefox with "deny network" profile you will still be able to browse as usual.
  - jbverschoor 1y ago
    same.. I use https://github.com/jrz/container-shell https://github.com/jrz/container-shell to start a fresh debian+tools image under the current directory, yet still allows me to easily open multiple terminals to the same instance. shell my:sandbox I also use sandbox-exec with limitations to the pwd, depending on what I want to exec.
- paulddraper 1y ago
  Agreed, macOS has lagged every other OS here. The easiest solution is to give up and use Linux (Docker).
- tux3 1y ago
  The ideal for me would be Asahi support from Apple, but the software support on their hardware is so far behind the hardware itself (which is amazing).
- bdash 1y ago
  It mostly seems to be deprecated to encourage developers to use App Sandbox rather than doing custom sandboxing things. With custom sandboxing baking implementation details of system frameworks into the sandbox policy is almost unavoidable, and Apple would really rather you didn't do that as it limits their ability to make changes in the future. The underlying sandbox subsystem is what App Sandbox uses. Apple can happily rely on implementation details of system frameworks in their policies because they can update them as the system frameworks change. The sandbox subsystem is what all of Apple's system software uses for sandboxing, as well as many security-conscious third-party programs such as web browsers. It's not going anywhere anytime soon, despite being marked as deprecated.
user_7832 1y ago
Tangential: Are there any good methods for windows/windows software? Hyper V is fine for small code, but if you want to install a program everytime it gets old really fast. I wouldn't want to trust random files off the internet either.
- int0x29 1y ago
  You can turn off win32k calls for a process if you don't need gui. You can also run the process with a lower privilege access token to reduce file access and some kernel access. I'd love to see one to block more kernel calls than just win32k. The best method I've come up with is to create a shared memory buffer to a seperate interface process and then unmount ntdll.dll by marking its pages `page_noaccess`. Thanks to win32 weirdness you can still allocate memory into the process without nt calls from the interface process as VirtualAllocEx, VirtualAlloc2, VirtualProtectEx, VirtualFreeEx, VirtualQueryEx, NtAllocateVirtualMemory, NtFreeVirtualMemory, etc take a process handle as an argument. This kinda requires writing a userspace kernel and your own standard library though. MS please give me a better method to lock down kernel access beyond nowin32k. Hyperv doesn't work for consumer apps as half the consumer versions of windows don't have it.
  - mike_hearn 1y ago
    Windows has a fairly capable sandbox called app isolation levels: https://learn.microsoft.com/en-us/windows/win32/secauthz/appcontainer-for-legacy-applications- https://learn.microsoft.com/en-us/windows/win32/secauthz/app... Look at how Chrome does it if you want to learn more. The API is classic Win32 unfortunately: extremely complicated, under-documented and full of razor sharp edges. The way Chrome does it also requires custom installer logic. But, it does exist.
    - mwcampbell 1y ago
      Why do you say the way Chrome does it requires custom installer logic? Electron is able to use Chromium's sandbox for renderer processes without imposing any installer requirements as far as I know.
PhilippGille 1y ago
Another comment already mentioned Chromium. In a similar ballbark I'd mention Deno for running TypeScript/JavaScript in a Sandbox that you have to give explicit permission for filesystem and network access [1]. And WebAssembly should probably be mentioned as well [2]. [1] https://docs.deno.com/runtime/fundamentals/security/ https://docs.deno.com/runtime/fundamentals/security/ [2] There are different runtimes, this is one of them: https://docs.wasmtime.dev/security.html https://docs.wasmtime.dev/security.html
- dgellow 1y ago
  I've been playing around with deno over the past weeks. It's definitely an interesting project. However I do find the permission system to lack the granularity I would want. You quickly end up in a "all or nothing" state, where I would really like to instead differentiate between code I consider trusted and code I consider risky. Still, pretty neat and I do see where I will use it in the future.
  - vlovich123 1y ago
    > instead differentiate between code I consider trusted and code I consider risky. You’re talking about trying to enforce privilege separation within a single process? For that you’d need capabilities ant the language level and even then I’m skeptical you can really lock things down successfully within a shared memory environment (yes JS in theory is a VM but there’s so many VM escapes possible that running untrusted code in process seems futile).
    - dgellow 1y ago
      I think so, yes. I would like to be able to say "import that module in no-network mode", if that makes sense (or the opposite, default imports to no fs, no network permissions, the grant explicitly).
      - vlovich123 1y ago
        Yeah this is particularly a problem for JS where importing code also immediately executes it. But yeah, managing capabilities within a process boundary is inherently trickier than doing it at the process boundary where you can actually guarantee permissions cannot be obtained through subterfuge.
jbverschoor 1y ago
Doesn't really matter as long as: 1) Developers flag "every permission" 2) No checks are happening at the distribution level
godelski 1y ago
Given the first line I think the OP should check out systemd. You can run something as a service and sandbox it that way or go to nspawn to do "chroot on steroids" or upgrade to a full virtual machine
charcircuit 1y ago
Android handles sandboxing for programs automatically. If programmers have to explicitly write code to sandbox things, most never will.
nesarkvechnep 1y ago
Capsicum is the most sophisticated of them all. It’s pretty great what you can do with it, coupled with Casper.
Defletter 1y ago
If I may just take this opportunity to moan about particular sandboxes: I use the flatpak version of Discord because of the promise of sandboxing in part because I hope it'll mitigate some of the telemetry happening but I doubt it does, but I digress. It is so annoying that anytime I want to drag a file into Discord, I first need to copy it to ~/Downloads. I'M GIVING YOU TO THE FILE, TAKE IT. I feel this same way about Android permissions too. I don't feel like "this button opens the camera and gives me the photo you take with it" and "I can access whatever the camera is seeing at this moment" should be the same permission. Hell, the former wouldn't even need to be a permission. Ditto with photos. Why do I need to give WhatsApp access to my photos to include a picture in my message? Just allow the button to open an Android OS element that it has no access to, then I can select a photo/photos through it, and then Android gives WhatsApp those photos. And if you take a photo from WhatsApp and want to save it, that should be just as easy, like downloading a file from a browser. I get the sense that most sandboxing/permission systems are just flags on specific API calls: you want to access a folder? well you need an fs permission for that! But don't worry, once you have permission, it's carte blanche! The only pipe-based sandboxing system I've encountered thus far is the share feature, but this is often so limited.
- glenjamin 1y ago
  I think in some cases (like WhatsApp) the better model exists and is available, but isn’t used by the app - possibly as a judge to get you to give it more permissions On iOS Strava’s app is able to access a photo picker, and the app only gets the photos I actually pick Meanwhile WhatsApp insists on using the model where it tries to access all photos, and I limit it to specific ones via the OS
  - mrbombastic 1y ago
    The more fine grained “only allow access to select photos” was introduced in iOS 14 and before that your only option was to ask for permissions for all photos. Not to say devs shouldn’t have converted by now but just to say it is possible they just implemented it that way at the time and never got around to updating rather than they really want the broader access.
oblio 1y ago
Maybe someone knows. There used to be a sort of Windows sandboxing or at least monitoring app named after a god, maybe 15,+ years ago. It could monitor what an app was doing at low level and I think it could even sandbox it. Does anyone know its name?
- zzo38computer 1y ago
  I do not remember knowing of such a thing (although I might have done and had forgotten), but I would like to see the documentation if it is available.
- out-of-ideas 1y ago
  there are api monitoring tools; my goto is this: https://learn.microsoft.com/en-us/sysinternals/downloads/procmon https://learn.microsoft.com/en-us/sysinternals/downloads/pro... MS had a tool that let you set an applications "observed" system variables, like OS ect; this was back in win2000 and before now modernization of the windows compatibility stuff, new stuff sort of superseded it. i currently recollect the exe name even after inspecting a win2000 iso - edit2: apparently apcompat.exe ( lol this archive page triggered some memories: https://ia802200.us.archive.org/view_archive.php?archive=/33/items/Windows.NETServer/ACT.iso&file=web%2Ftoolkit%2FACT%2Fhtml%2Fdefault.htm https://ia802200.us.archive.org/view_archive.php?archive=/33... ) edit: there were even api firewalls, zonealarm had one, and a number of others. i think people lost interest in locking their systems down as they seem very unpopular nowadays
  - oblio 1y ago
    It might have been Sandboxie. I don't remember where I got the dog reference (not god, typo in the original post), but it seems to have been a classic Windows MFC app, and it does date back to 2004, so it would fit the timeframe. I don't remember using it much, I guess configuration was cumbersome, as it generally is for these kinds of per-app/per-permission manual configuration tools.
    - out-of-ideas 1y ago
smartaz42 1y ago
I haven't personally used it but cosmopolitan claims to provide a simple and portable sandboxing capability
beefnugs 1y ago
No mentions of "Syd" anyone use this yet?
codedokode 1y ago
In practice, you need to do more than use existing file descriptors. You want a sandboxed program to be able to display windows, use graphic acceleration, play and record audio, have limited access to dbus, integrate with other sanboxed programs. This is where you cannot get away with 112 lines of code. For example, to play audio, one has to use pulseaudio protocol and create a fake ALSA device in the sandbox because pipewire doesn't have simpler way to share the access between different users. Also this does not prevent the untrusted program from reading audio card vendor and name. Some applications like Chromium use privileged SUID helper so I am not sure if it is possible to sandbox them at all. Electron-based apps are also a pain to make work in a sandbox, for example, without /proc and graphic acceleration. The state of sandboxing on Linux is pretty sad at present moment, and almost everything runs without any restrictions. Compare to Android or iOS where sandboxing was implemented from the start. It is easier and more reliable just to use a virtual machine with a full OS for sandboxing. There is flatpak, but as I understand, it doesn't prevent the application from reading OS and hardware identifiers via /proc and /sys for example. Also some flatpak apps use "classic" confinement which contrary to the name means no confinement at all.
Joker_vD 1y ago
> How easy is it for a developer to "sandbox" their program? Why on earth is that the program developer's job and/or duty? If the user (stupidly) wants to run a program completely un-sandboxed, that's their right. If they want to run all programs by default somewhat sandboxed (which is quite reasonable), that's also the user's right and their system's job. Not of the original developer who made the program. But if you want to run some other program sandboxed, I've heard that "podman run --network=none" works reasonably well.
- cedws 1y ago
  The developer knows the program best - what files it needs to access, what syscalls it needs to make, etc.
  - SpaghettiCthulu 1y ago
    What if the user doesn't trust the developer?
    - Spivak 1y ago
      Out of scope—pledge is designed to allow developers to sandbox their own programs to deal with compromises. If someone finds a bug with your program that tricks it into opening an arbitrary file then pledge just saved you. These sandboxing tools aren't designed to make it safe to run arbitrary untrusted code. If you want that then you're looking at a VM- either a full VM like firecracker or a software VM like V8.
  - Joker_vD 1y ago
    So? You seem to be missing the minor premise in your comment which explains how having the knowledge of the program's inner workings translates into putting you in charge of deciding how to sand box it. In fact I'd argue it's precisely the lack of such knowledge which makes sandboxing useful: after all, if I knew that the program won't touch or call anything sensitive, I would just simply run it as-is; contrariwise, if I knew it would steal my bank login info and send it to Serbia, I would just not run it at all. EDIT: Don't get me wrong, I don't have anything against applications putting themselves into restricted modes, and splitting potentially sensitive logic into separate processes; but that functionality really should also be exposed to an end-user as well, akin to $ pledge --promises=stdin --chroot=/var/empty --cwd=/ -- suspicious_program
ForHackernews 1y ago
Bit strange to approach this from the app dev perspective. Surely it's operating systems and users who care about sandboxing apps? As a developer, I'll live with whatever restrictions I need to, but I'm not sure why I'd go to extra hassle making my life harder in order to secure your system against code that I trust (I just wrote it!)
theamk 1y ago
Looks like there is a glaring omission: on Linux, the best way to sandbox program is via systemd service file, which is only a few lines of ini file, no matter what your source code is written as. This is especially bad for the second part - if you are comparing existing open-source sandbox solution, you should not ignore the most common method on Linux!
Jacques2Marais 1y ago
Another challenge is a shift from sandboxing your own application to running untrusted, 3rd-party code in the cloud (e.g, for AI agents or a plugin system). Devs are forced to build an entire isolation infrastructure from scratch, or to use a complex compute platform like RunPod or Modal for simple code execution. You end up having to manage the ops overhead just for a simple feature. We found this exact issue quite frustrating and needed an API with its primary feature being dead-simple, high-security ephemeral execution. And so we're building Stonebox, an API that provides that strong, gVisor-based isolation for arbitrary code without any of the setup or maintenance complexity. Here's our approach if you're curious: https://stonebox.plust.click/ https://stonebox.plust.click/

66 points by zdw 1y ago

While interesting, the failure to distinguish between cooperative and unmodified programs here sort-of weakens the comparison. I mean, the OpenBSD APIs are great and all, but most developers are not going to be aware of these, nor deploying to a platform that supports these in the first place. And yes, kernel-mode supervisors, when available, suffer from inscrutable configurations, so it's clear a middle ground would be nice (especially one that also applies to the W-environment), but it's not clear anyone is particularly invested in this?

ykonstant 1y ago
Indeed, if you are trying to build something cross-platform and use BSD's specific APIs for security, it is easy to end up with an #ifdef soup in some of the most sensitive parts of your code. One wrong logic step there and you have compromised your application trying to harden it. I don't know the solution :(
deleted 1y ago
[deleted]

petermcneeley 1y ago

For obvious reasons chromium has pretty extensive sandboxing. You can read the source right here: https://source.chromium.org/chromium/chromium/src/+/main:content/gpu/gpu_main.cc;l=463?q=gpu_main.cc https://source.chromium.org/chromium/chromium/src/+/main:con...

simonw 1y ago
Looks like that's the subset of their sandbox that applies to GPUs, the file is content/gpu/gpu_main.cc
bqmjjx0kac 1y ago
Here's a more informative doc about sandboxing in Chromium https://source.chromium.org/chromium/chromium/src/+/main:sandbox/README.md?q=sandbox%20file:md$&ss=chromium%2Fchromium%2Fsrc https://source.chromium.org/chromium/chromium/src/+/main:san...

hdjrudni 1y ago

I'm interested in this for an upcoming project, but complexity of setup doesn't seem like a great way to compare these projects. What I need to know is (a) can I run completely untrusted code in these sandboxes? (b) Which let me disable network access, file system access, and limit CPU and RAM usage? i.e. feature set. The set up might be a pain in the butt, but I'm assuming I only have to do it once and then I can stuff arbitrary programs into it.

simonw 1y ago

The situation on macOS is so frustrating. sandbox-exec / seatbelt has been marked as deprecated for nearly a decade now (since macOS Sierra in 2016) but it's still what everyone uses - here's OpenAI using it for their new Codex CLI: https://github.com/openai/codex/issues/215 https://github.com/openai/codex/issues/215 Maybe the new "containers" stuff in macOS 26 is going to be a good replacement for that? It seems like that's a different solution though. All I want is an easy, documented, supported way to run a binary on my computer and say "it can only access these files, use this much RAM and it's not allowed to make any outbound network requests". It always surprises me how hard this is!

throwaway290 1y ago
I use Docker for this. Sandbox is not effective. Like if you run Firefox with "deny network" profile you will still be able to browse as usual.
- jbverschoor 1y ago
  same.. I use https://github.com/jrz/container-shell https://github.com/jrz/container-shell to start a fresh debian+tools image under the current directory, yet still allows me to easily open multiple terminals to the same instance. shell my:sandbox I also use sandbox-exec with limitations to the pwd, depending on what I want to exec.
paulddraper 1y ago
Agreed, macOS has lagged every other OS here. The easiest solution is to give up and use Linux (Docker).
tux3 1y ago
The ideal for me would be Asahi support from Apple, but the software support on their hardware is so far behind the hardware itself (which is amazing).
bdash 1y ago
It mostly seems to be deprecated to encourage developers to use App Sandbox rather than doing custom sandboxing things. With custom sandboxing baking implementation details of system frameworks into the sandbox policy is almost unavoidable, and Apple would really rather you didn't do that as it limits their ability to make changes in the future. The underlying sandbox subsystem is what App Sandbox uses. Apple can happily rely on implementation details of system frameworks in their policies because they can update them as the system frameworks change. The sandbox subsystem is what all of Apple's system software uses for sandboxing, as well as many security-conscious third-party programs such as web browsers. It's not going anywhere anytime soon, despite being marked as deprecated.

user_7832 1y ago

Tangential: Are there any good methods for windows/windows software? Hyper V is fine for small code, but if you want to install a program everytime it gets old really fast. I wouldn't want to trust random files off the internet either.

int0x29 1y ago
You can turn off win32k calls for a process if you don't need gui. You can also run the process with a lower privilege access token to reduce file access and some kernel access. I'd love to see one to block more kernel calls than just win32k. The best method I've come up with is to create a shared memory buffer to a seperate interface process and then unmount ntdll.dll by marking its pages `page_noaccess`. Thanks to win32 weirdness you can still allocate memory into the process without nt calls from the interface process as VirtualAllocEx, VirtualAlloc2, VirtualProtectEx, VirtualFreeEx, VirtualQueryEx, NtAllocateVirtualMemory, NtFreeVirtualMemory, etc take a process handle as an argument. This kinda requires writing a userspace kernel and your own standard library though. MS please give me a better method to lock down kernel access beyond nowin32k. Hyperv doesn't work for consumer apps as half the consumer versions of windows don't have it.
- mike_hearn 1y ago
  Windows has a fairly capable sandbox called app isolation levels: https://learn.microsoft.com/en-us/windows/win32/secauthz/appcontainer-for-legacy-applications- https://learn.microsoft.com/en-us/windows/win32/secauthz/app... Look at how Chrome does it if you want to learn more. The API is classic Win32 unfortunately: extremely complicated, under-documented and full of razor sharp edges. The way Chrome does it also requires custom installer logic. But, it does exist.
  - mwcampbell 1y ago
    Why do you say the way Chrome does it requires custom installer logic? Electron is able to use Chromium's sandbox for renderer processes without imposing any installer requirements as far as I know.

PhilippGille 1y ago

Another comment already mentioned Chromium. In a similar ballbark I'd mention Deno for running TypeScript/JavaScript in a Sandbox that you have to give explicit permission for filesystem and network access [1]. And WebAssembly should probably be mentioned as well [2]. [1] https://docs.deno.com/runtime/fundamentals/security/ https://docs.deno.com/runtime/fundamentals/security/ [2] There are different runtimes, this is one of them: https://docs.wasmtime.dev/security.html https://docs.wasmtime.dev/security.html

dgellow 1y ago
I've been playing around with deno over the past weeks. It's definitely an interesting project. However I do find the permission system to lack the granularity I would want. You quickly end up in a "all or nothing" state, where I would really like to instead differentiate between code I consider trusted and code I consider risky. Still, pretty neat and I do see where I will use it in the future.
- vlovich123 1y ago
  > instead differentiate between code I consider trusted and code I consider risky. You’re talking about trying to enforce privilege separation within a single process? For that you’d need capabilities ant the language level and even then I’m skeptical you can really lock things down successfully within a shared memory environment (yes JS in theory is a VM but there’s so many VM escapes possible that running untrusted code in process seems futile).
  - dgellow 1y ago
    I think so, yes. I would like to be able to say "import that module in no-network mode", if that makes sense (or the opposite, default imports to no fs, no network permissions, the grant explicitly).
    - vlovich123 1y ago
      Yeah this is particularly a problem for JS where importing code also immediately executes it. But yeah, managing capabilities within a process boundary is inherently trickier than doing it at the process boundary where you can actually guarantee permissions cannot be obtained through subterfuge.

jbverschoor 1y ago

Doesn't really matter as long as: 1) Developers flag "every permission" 2) No checks are happening at the distribution level

godelski 1y ago

Given the first line I think the OP should check out systemd. You can run something as a service and sandbox it that way or go to nspawn to do "chroot on steroids" or upgrade to a full virtual machine

charcircuit 1y ago

Android handles sandboxing for programs automatically. If programmers have to explicitly write code to sandbox things, most never will.

nesarkvechnep 1y ago

Capsicum is the most sophisticated of them all. It’s pretty great what you can do with it, coupled with Casper.

Defletter 1y ago

If I may just take this opportunity to moan about particular sandboxes: I use the flatpak version of Discord because of the promise of sandboxing in part because I hope it'll mitigate some of the telemetry happening but I doubt it does, but I digress. It is so annoying that anytime I want to drag a file into Discord, I first need to copy it to ~/Downloads. I'M GIVING YOU TO THE FILE, TAKE IT. I feel this same way about Android permissions too. I don't feel like "this button opens the camera and gives me the photo you take with it" and "I can access whatever the camera is seeing at this moment" should be the same permission. Hell, the former wouldn't even need to be a permission. Ditto with photos. Why do I need to give WhatsApp access to my photos to include a picture in my message? Just allow the button to open an Android OS element that it has no access to, then I can select a photo/photos through it, and then Android gives WhatsApp those photos. And if you take a photo from WhatsApp and want to save it, that should be just as easy, like downloading a file from a browser. I get the sense that most sandboxing/permission systems are just flags on specific API calls: you want to access a folder? well you need an fs permission for that! But don't worry, once you have permission, it's carte blanche! The only pipe-based sandboxing system I've encountered thus far is the share feature, but this is often so limited.

glenjamin 1y ago
I think in some cases (like WhatsApp) the better model exists and is available, but isn’t used by the app - possibly as a judge to get you to give it more permissions On iOS Strava’s app is able to access a photo picker, and the app only gets the photos I actually pick Meanwhile WhatsApp insists on using the model where it tries to access all photos, and I limit it to specific ones via the OS
- mrbombastic 1y ago
  The more fine grained “only allow access to select photos” was introduced in iOS 14 and before that your only option was to ask for permissions for all photos. Not to say devs shouldn’t have converted by now but just to say it is possible they just implemented it that way at the time and never got around to updating rather than they really want the broader access.

oblio 1y ago

Maybe someone knows. There used to be a sort of Windows sandboxing or at least monitoring app named after a god, maybe 15,+ years ago. It could monitor what an app was doing at low level and I think it could even sandbox it. Does anyone know its name?

zzo38computer 1y ago
I do not remember knowing of such a thing (although I might have done and had forgotten), but I would like to see the documentation if it is available.
out-of-ideas 1y ago
there are api monitoring tools; my goto is this: https://learn.microsoft.com/en-us/sysinternals/downloads/procmon https://learn.microsoft.com/en-us/sysinternals/downloads/pro... MS had a tool that let you set an applications "observed" system variables, like OS ect; this was back in win2000 and before now modernization of the windows compatibility stuff, new stuff sort of superseded it. i currently recollect the exe name even after inspecting a win2000 iso - edit2: apparently apcompat.exe ( lol this archive page triggered some memories: https://ia802200.us.archive.org/view_archive.php?archive=/33/items/Windows.NETServer/ACT.iso&file=web%2Ftoolkit%2FACT%2Fhtml%2Fdefault.htm https://ia802200.us.archive.org/view_archive.php?archive=/33... ) edit: there were even api firewalls, zonealarm had one, and a number of others. i think people lost interest in locking their systems down as they seem very unpopular nowadays
- oblio 1y ago
  It might have been Sandboxie. I don't remember where I got the dog reference (not god, typo in the original post), but it seems to have been a classic Windows MFC app, and it does date back to 2004, so it would fit the timeframe. I don't remember using it much, I guess configuration was cumbersome, as it generally is for these kinds of per-app/per-permission manual configuration tools.
  - out-of-ideas 1y ago

smartaz42 1y ago

I haven't personally used it but cosmopolitan claims to provide a simple and portable sandboxing capability

beefnugs 1y ago

No mentions of "Syd" anyone use this yet?

codedokode 1y ago

In practice, you need to do more than use existing file descriptors. You want a sandboxed program to be able to display windows, use graphic acceleration, play and record audio, have limited access to dbus, integrate with other sanboxed programs. This is where you cannot get away with 112 lines of code. For example, to play audio, one has to use pulseaudio protocol and create a fake ALSA device in the sandbox because pipewire doesn't have simpler way to share the access between different users. Also this does not prevent the untrusted program from reading audio card vendor and name. Some applications like Chromium use privileged SUID helper so I am not sure if it is possible to sandbox them at all. Electron-based apps are also a pain to make work in a sandbox, for example, without /proc and graphic acceleration. The state of sandboxing on Linux is pretty sad at present moment, and almost everything runs without any restrictions. Compare to Android or iOS where sandboxing was implemented from the start. It is easier and more reliable just to use a virtual machine with a full OS for sandboxing. There is flatpak, but as I understand, it doesn't prevent the application from reading OS and hardware identifiers via /proc and /sys for example. Also some flatpak apps use "classic" confinement which contrary to the name means no confinement at all.

Joker_vD 1y ago

> How easy is it for a developer to "sandbox" their program? Why on earth is that the program developer's job and/or duty? If the user (stupidly) wants to run a program completely un-sandboxed, that's their right. If they want to run all programs by default somewhat sandboxed (which is quite reasonable), that's also the user's right and their system's job. Not of the original developer who made the program. But if you want to run some other program sandboxed, I've heard that "podman run --network=none" works reasonably well.

cedws 1y ago
The developer knows the program best - what files it needs to access, what syscalls it needs to make, etc.
- SpaghettiCthulu 1y ago
  What if the user doesn't trust the developer?
  - Spivak 1y ago
    Out of scope—pledge is designed to allow developers to sandbox their own programs to deal with compromises. If someone finds a bug with your program that tricks it into opening an arbitrary file then pledge just saved you. These sandboxing tools aren't designed to make it safe to run arbitrary untrusted code. If you want that then you're looking at a VM- either a full VM like firecracker or a software VM like V8.
- Joker_vD 1y ago
  So? You seem to be missing the minor premise in your comment which explains how having the knowledge of the program's inner workings translates into putting you in charge of deciding how to sand box it. In fact I'd argue it's precisely the lack of such knowledge which makes sandboxing useful: after all, if I knew that the program won't touch or call anything sensitive, I would just simply run it as-is; contrariwise, if I knew it would steal my bank login info and send it to Serbia, I would just not run it at all. EDIT: Don't get me wrong, I don't have anything against applications putting themselves into restricted modes, and splitting potentially sensitive logic into separate processes; but that functionality really should also be exposed to an end-user as well, akin to $ pledge --promises=stdin --chroot=/var/empty --cwd=/ -- suspicious_program

ForHackernews 1y ago

Bit strange to approach this from the app dev perspective. Surely it's operating systems and users who care about sandboxing apps? As a developer, I'll live with whatever restrictions I need to, but I'm not sure why I'd go to extra hassle making my life harder in order to secure your system against code that I trust (I just wrote it!)

theamk 1y ago

Looks like there is a glaring omission: on Linux, the best way to sandbox program is via systemd service file, which is only a few lines of ini file, no matter what your source code is written as. This is especially bad for the second part - if you are comparing existing open-source sandbox solution, you should not ignore the most common method on Linux!

Jacques2Marais 1y ago

Another challenge is a shift from sandboxing your own application to running untrusted, 3rd-party code in the cloud (e.g, for AI agents or a plugin system). Devs are forced to build an entire isolation infrastructure from scratch, or to use a complex compute platform like RunPod or Modal for simple code execution. You end up having to manage the ops overhead just for a simple feature. We found this exact issue quite frustrating and needed an API with its primary feature being dead-simple, high-security ephemeral execution. And so we're building Stonebox, an API that provides that strong, gVisor-based isolation for arbitrary code without any of the setup or maintenance complexity. Here's our approach if you're curious: https://stonebox.plust.click/ https://stonebox.plust.click/