Software Sandboxing: The Basics
3 hours ago
- Sandboxing is defined as discretionary privilege dropping: programmatically restricting privileges without administrative authority.
- Programmatic privilege dropping requires OS-specific interfaces like FreeBSD's Capsicum and Linux's Seccomp, as traditional UNIX permissions are inadequate.
- Avoid relying on superuser mechanisms (e.g., suid binaries) for sandboxing; Linux namespaces introduce security risks and are better suited for containerization.
- The actor model (processes as actors) combined with capability-based security (using file descriptors as capabilities) provides a robust framework for compartmentalized sandboxing.
- Capsicum (FreeBSD) is highlighted as a superior sandboxing mechanism, requiring only ~100 lines of code to integrate, compared to thousands for other systems.
- Non-blocking I/O on UNIX presents challenges; careful handling of file descriptors and use of proactors or io_uring is needed to avoid DoS vulnerabilities.
- Existing code can be sandboxed via libc interposition (e.g., LD_PRELOAD) using tools like Super Capsicumizer 9000 or Emilua's libc_service module.
- Seccomp (Linux) is complex and error-prone due to multiarch issues and syscall numbering; Kafel helps define syscall policies but has limitations.
- Practical examples with Emilua show how to spawn sandboxed actors, restrict file access, and handle legacy code through dynamic policy enforcement.
- Threat models must be evaluated critically: sandboxing is not always necessary but crucial for software handling sensitive data (e.g., Telegram's tdlib).