Sandboxing a Linux Application

on YouTube ↗01h 25m

" summary

Walks through building a minimal but fragile Linux sandbox that actually runs an injected binary, demonstrating use of namespaces (user, mount, pid, net), replacing root with pivot_root rather than chroot, filtering syscalls with seccomp (libseccomp to avoid raw BPF pain), and limiting resources with cgroups v2. Shows live failures (missing /proc, killed syscalls, OOM when memory limits hit), warns the code is unsafe for production, and explains how Docker and Chromium reuse these APIs.

AI-written summary · about

" chapters (20)

1. 0:00Start
2. 3:54What Is a Sandbox
3. 5:04Why Would You Sandbox
4. 11:58Ld Preload
5. 17:27Namespaces
6. 18:10Permission Model
7. 20:42Create a New Username Space
8. 31:36Pivot Route
9. 39:16Network Namespace
10. 44:22Secomp
11. 48:51Checking Architecture
12. 53:49Checking of Arguments
13. 56:13Architecture Check
14. 59:53How Can I Compare Strings
15. 1:05:47C Groups
16. 1:12:46Memory Controller
17. 1:15:57Disable the Memory Controller
18. 1:17:27Cpu Burn
19. 1:18:47Cpu Weight
20. 1:22:04Cpu Set

" related talks

• 42mSandboxing a Linux applicationMartin Ertsås · NDC TechTown 2021
• 01h 02mSandboxing a Linux ApplicationMartin Ertsås · NDC Security 2022
• 38mSandboxing in Linux with zero lines of codeIgnat Korchagin · NDC Security 2024
• 50mLinux Security and How Web Browser Sandboxes Really WorkPatricia Aas · NDC Oslo 2017
• 46mLinux Security APIs and the Chromium SandboxPatricia Aas · NDC TechTown 2018
• 55mLinux Security APIs and the Chromium SandboxPatricia Aas · NDC Security Oslo 2019
• 01h 31mTutorial: Using Linux Primitives to Build Your Own ContainersChristian Brauner, Stephane Graber · Linux Security Summit Europe 2019
• 22mSandboxes all the way down - A hitchhiker's guide to platform...Tom DNetto · BSidesSF 2023