2 ms·
One downside of fine-grained sandboxing is the overhead, as each (function) call into a library now has to cross sandbox boundaries. Even if we assume overhead
by warkdarrior 1y ago
One downside of fine-grained sandboxing is the overhead, as each (function) call into a library now has to cross sandbox boundaries.
Even if we assume overhead is magically brought to zero, the real challenge is customizing the permission policy for each sandbox. I add, say, 5 new dependencies to my program, and now I have to review source code of each of those dependencies and determine what permissions their corresponding sandboxes get. The library that connects to a database server? Maybe it also needs filesystem access to cache things. The library that parses JSON buffers? Maybe it also needs network access to download the appropriate JSON schema on the fly. The library that processes payments? Maybe it also needs access to location information to do risk analysis.
Are all developers able to define the right policies for every dependency?
- zzo38computer 1y agoI think using proxy capabilities would partially mitigate this issue, and effectively they would work by using interfaces rather than permissions. By itself, it will not do; documentation will also be helpful, as well as deciding what you will need for your specific application (which are helpful even independently of such things as this).