Re:Show HN: Sandy – A tiny Sandbox to run untrusted code ️
by roryrjb on Monday January 13, 2020 @02:59AM
(#22032672)
I don't think this really is what people might call a sandbox but it can optionally block or allow syscalls happening (in my mind only one aspect of a sandbox) and it looks like it's interactive. I think this is great. OpenBSD has had great success with pledge and I have been experimenting with seccomp (via the libseccomp project) with both Node.js bindings and a cli in C for doing a very similar thing as Sandy (although not interactively, which is a nice touch).
[ Parent
| on HN ]
Re:Show HN: Sandy – A tiny Sandbox to run untrusted code ️
by ignoramous on Monday January 13, 2020 @08:09AM
(#22034096)
Take a look at MIT's Mbox: https://news.ycombinator.com/item?id=7214419
Firejail is another worthwhile alternative: https://news.ycombinator.com/item?id=12239840
I stumbled on Solo5 (runs MirageOS/IncludeOS unikernels on Linux) this past month which looked promising: https://github.com/solo5/solo5
Re:Show HN: Sandy – A tiny Sandbox to run untrusted code ️
by craig on Monday January 13, 2020 @03:09AM
(#22032706)
Yeah, "sandbox" is definitely a stretch, but I couldn't think of a similar but descriptive term. I've also found since posting there are definitely some easy to expose security wholes where the syscalls aren't traced in threads and child processes. So there is lots of room for improvement. I'll take a look at the projects you mentioned to see how they've tackled those issues. Thanks!