Software sandboxing: The basics (2025)

summary

Effective software sandboxing should be implemented as discretionary privilege dropping, where a process intentionally restricts its own access to system resources. This is best achieved by adopting an actor-model architecture based on compartmentalization into separate processes that communicate via message passing. By treating file descriptors as unforgeable capabilities, developers can create secure, granular access control policies that prevent compromised components from accessing the rest of the system.

key points

1. The actor model provides a powerful framework for sandboxing by treating each process as an actor that shares no memory and communicates solely through UNIX domain sockets, allowing for flexible and resource-restricted topologies.
2. FreeBSD's Capsicum is presented as the gold standard for sandboxing because it allows a process to enter a capability mode via cap_enter(), which completely disables ambient authority and forces all system interactions to occur through existing file descriptors.
3. On Linux, sandboxing is more complex due to thes a lack of a single 'capability mode' and the combination of seccomp and Landlock is required to filter syscalls and filesystem access, though tools like Kafel can help manage these complex policies.

who should read it

Software engineers and security researchers interested in implementing robust process-level isolation and privilege restriction in their applications.

discussion positive