SandBox Mode (SBM) - New Execution Mode Between Kernel and User Space
Talkat Linux Security Summit North America 2024 · on Friday, 2024-04-19· at 14:50· Terrace Suite 1+2·
summary
SandBox Mode (SBM) introduces a new CPU-level execution mode between kernel and user space that runs selected kernel functions in an isolated address space, aborting on out-of-bounds writes and leaving kernel memory intact. It claims 100% precise like KASAN while matching HEKI effectiveness without a hypervisor, maps kernel text into the sandbox, uses copy-in/copy-out buffers and page-granularity aborts, runs sandbox code at CPL 3 on x86 with lazy TLB tricks, costs under 1 ms to enter/exit on a 3 GHz CPU, and requires explicit per-function adaptation and shared-data specification.
AI-written summary · about
chapters (14)
- 0:00SandBox Mode introduction
- 1:30Why new execution mode
- 3:18Kernel workload options
- 7:58SandBox Mode concept
- 10:07Isolation strength
- 12:19Process modes integration
- 15:53Code conversion example
- 16:34CPU-level isolation
- 21:13Performance impact
- 23:00Use cases
- 24:27ARM64 implementation
- 26:36Context switching overhead
- 29:06Handling GP faults
- 29:56Q&A
related talks
22mPrivbox: Faster System Calls Through Sandboxed Privileged Execution
21mDetection of Advanced Attacks with a CPU Level Sandbox Technology
47mSecure Sandboxing in a Post-Spectre World
32mLinux Sandboxing with Landlock
38mSandboxing in Linux with zero lines of code
26mSyscall Me by Your Name: Sandboxing Wasm Programs
19mSandbox to confidential containers: A brief on the evolution of container isolation
37mSandboxing Applications with Landlock