Jump to content

User:ScotXW/Sandboxes on Linux

From Wikipedia, the free encyclopedia
  • Issues of iX, c't, de:Linux-Magazin in Years 2014/2015 contain a couple of comprehensive articles on the available Linux solutions even with their history!

Sandboxes on Linux looks at the different mechanisms there are to implement sandbox on Linux = Linux kernel-based family of operating systems. With regard to the article sandbox being a pile of crap: July 2014 it is hard to document these software project, since we cannot just refer to the article to explain the underlying mechanisms and their merits. I doubt Wikipedia will ever attract good writers... its not the money, its the idiots being around here, and throwing money at it, will not help. Best follow Helmuth von Moltke the Elder advise and send them far far away...

  1. I think User:ScotXW/Virtualization introduced sandboxes and containers. If there is a difference between a sandbox and a container, I guess sandbox = for 1 application, container = for n applications. Sandbox was originally only for security, but nothing speaks against applying resource management to it.

Comparison

[edit]
Sandboxing Chromium (based on Jonathan Anderson at FOSDEM2014)
OS Techinque LoC FS IPC NET S≠S' Priv
Windows DAC ACLs 22,350 No No Yes Windows ACLs and SIDs
Linux chroot 600 Yes No No Yes No SUID-root sandbox helper
SELinux 200 Yes Yes No No Type Enforcement sandbox domain
seccomp 11,300 Yes Yes Yes Yes seccomp and userspace syscall wrapper
kdbus & cgroups ? ? ? ? ? ? also facilitates resource management; systemd-nspawn(1)
OS X Sandbox 560 Yes Yes Yes Yes Seatbelt? Path-based MAC sandbox
FreeBSD Capsicum 100 Yes Yes Yes Yes Yes Capsicum sandboxing using cap_enter

References

[edit]
  1. ^ "Understanding the Access Control Model for Tizen Application Sandboxing". Archived from the original (PDF) on 2012-09-12.
  2. ^ "Capsicum: practical capabilities for UNIX" (PDF). 2010.
  3. ^ "Capsicum: practical capabilities for UNIX". LWN.net. 2012-02-22.
  4. ^ "Capsicum in the Linux kernel". LWN.net. 2014-07-01.