Minijail: Running Untrusted Programs Safely
summary
Minijail is a Google-built sandboxing helper that composes namespaces, capabilities, seccomp and pivot_root into one tested binary and API, and it already runs Android inside a Chrome OS container and sandboxes fuzz targets. It reduces 15+ lines to 1–3 to set up capabilities, applies an LD_PRELOAD loader so policies hit before main, and limits a simple program like cat to 9 syscalls while the Chrome renderer sheds >50% of exposed syscalls. It is used in ClusterFuzz, Chrome OS and Android.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 1:00Why Minijail
- 3:51The Problem
- 8:50Capabilities
- 14:18Policies
- 18:39File System Capabilities
- 21:08Process Capabilities
- 23:21namespaces
- 24:07Pin namespace
- 27:58User names
- 29:59Android
- 32:40Acknowledgements
- 34:27Questions
related talks
01h 25mSandboxing a Linux Application
09mLightning Talk: Enabling “Safe” Use of Untrusted Open Source Dependencies with Sandboxing
38mSandboxing in Linux with zero lines of code
32mLLMs Behind Bars: Sandboxes at Scale for AI on a Short Leash
22mSandboxes all the way down - A hitchhiker's guide to platform...
46mLinux Security APIs and the Chromium Sandbox
50mLinux Security and How Web Browser Sandboxes Really Work
48mA Novel Runtime Technique For Identifying Malicious Applications