Sandboxing a Linux Application
summary
Shows exactly how to build a Linux sandbox: create a new user namespace to become “root-ish,” make a private mount namespace and pivot_root into a tmpfs-based root, fork into a new PID namespace so the child is PID 1, and drop the network with a new net namespace so the process sees no interfaces. Demonstrates an ld_preload override of __libc_start_main to inject setup, uses seccomp and libseccomp for syscall whitelists (with logging/audit during development), and reminds to drop unneeded capabilities and test filters across glibc versions.
AI-written summary · about
chapters (27)
- 0:00Intro
- 0:29Who am I
- 1:04Disclaimer
- 1:51What is a Sandbox
- 2:56Why use a Sandbox
- 3:48Application expectations
- 5:29Setting up a sandbox
- 7:03Example application
- 9:13namespaces
- 10:09usernamespace
- 11:02mappings
- 12:31running as root
- 15:01making a new file system
- 16:35making a new mount point
- 17:27making a temporary file system
- 19:27proc file system
- 20:39new proc namespace
- 21:59pid namespace
- 23:39Create new namespace
- 28:39Clone newnet
- 29:16Build the application
- 30:50Protect the system
- 31:16Seccomp
- 33:56Seccomp Program
- 41:55libsec comp
- 44:32argument checks
- 47:37compare strings
related talks
42mSandboxing a Linux application
01h 25mSandboxing a Linux Application
38mSandboxing in Linux with zero lines of code
37mSandboxing Applications with Landlock
01h 31mTutorial: Using Linux Primitives to Build Your Own Containers
50mLinux Security and How Web Browser Sandboxes Really Work
47mLinux user namespaces: a blessing and a curse
32mLinux user namespaces: a blessing and a curse