Enter Sandbox
summary
Automatic seccomp generation named Chestnut combines a compiler plugin (Sourcealyzer), a binary analyzer (Binalyzer), and a runtime tracer (Finalizer) plus patcher/generator and libchestnut to install filters. Evaluation shows static approach blocks about 87% of Linux syscalls and binary extraction blocks 83%, mitigates ~62–64% of exploit-linked CVEs (75/72% for subvariants), worst compile overhead ~28% (~19s), ffmpeg binary extraction ~11 minutes, test-suite coverage 59–77% lines and 61–92% functions, and six months of nginx hosting without crashes.
AI-written summary · about
chapters (21)
- 0:00Intro
- 1:07Motivation
- 3:14Linux Seccomp
- 4:17Seccomp BPF
- 5:32libseccomp
- 6:30Challenges
- 8:59Sourcalyzer
- 10:10Call Graph Example
- 13:35Key Aspects
- 16:19Binalyzer: Overview
- 18:59System Call Mapping
- 20:52Finalyzer: Overview
- 22:15libchestnut
- 23:22ChestnutPatcher and Chestnut Generator
- 25:32Evaluation: Performance
- 26:11Evaluation: Seccomp
- 27:09Evaluation: Functional Correctness
- 28:49Evaluation Security
- 30:11Mitigating Real-World Exploits
- 32:05Return-oriented programming
- 34:25Recap
related talks
38mSandboxing in Linux with zero lines of code
11mPlaying in the Sandbox: A Study on the Usability of Seccomp
01h 25mSandboxing a Linux Application
19mBuilding Dynamic System Call Sandbox with Partial Order Analysis
42mSandboxing a Linux application
44mSlime: Automated Anti-Sandboxing Disarmament System
26mSyscall Me by Your Name: Sandboxing Wasm Programs
33mOpen & Secure: Novel Sandboxing Technique for Any Open Source Library