Sandboxing in Linux with zero lines of code
summary
Claims a way to sandbox any Linux binary without changing its source by injecting seccomp policies at runtime; demonstrates a toolkit with a shared library plus a launcher that uses libseccomp and LD_PRELOAD (or binary patching) to enforce filters including blocking execve where systemd can’t. Shows concrete demos: uname syscall denied (process killed or returns ENETDOWN), and a measured allowlist difference of 4 vs 13 syscalls between library-injected and launcher approaches. Tool is open source on GitHub as sandboxify and works for static and dynamic binaries.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 1:07System calls
- 10:23Set comp
- 18:05Code set comp
- 24:26Why is execv dangerous
- 25:25Sandboxing Toolset
- 26:43LD Preload
- 29:01patching binary
- 29:57static link applications
- 31:09Cloud for Sandboxing tool
- 32:41Sandbox Toolkit
- 33:37Why is it important
- 35:43Example
- 37:08Useful links
related talks
42mSandboxing a Linux application
01h 25mSandboxing a Linux Application
01h 02mSandboxing a Linux Application
37mSandboxing Applications with Landlock
11mPlaying in the Sandbox: A Study on the Usability of Seccomp
33mOpen & Secure: Novel Sandboxing Technique for Any Open Source Library
09mLightning Talk: Enabling “Safe” Use of Untrusted Open Source Dependencies with Sandboxing
44mSeccomp for Developers - Making Applications Simply More Secure