Linux Security APIs and the Chromium Sandbox
summary
Chromium builds its Linux sandbox by forking/cloning a single browser binary into a small set of processes (browser, zygote/zygote child, GPU, and one renderer per tab) and then applying concrete primitives: user+PID+net namespaces (with a setuid fallback if user namespaces are blocked), seccomp-BPF policies generated from C++ policy switches, capability dropping, setrlimit, and a chroot-like trick using CLONE_FS plus chdir into /proc/self/fdinfo so the child loses filesystem access; cgroups appear only on Chromebook. The code uses clone with a longjmp wrapper to emulate fork semantics.
AI-written summary · about
chapters (14)
- 0:00Start
- 7:25a little bit about the linux security api '
- 10:20limit your access to certain resources
- 10:32start setting up the sandbox
- 10:54start up your browser process
- 12:20load a program into a processor
- 15:11look at namespaces
- 15:44create the sandbox
- 16:09create a user name space as an unprivileged user
- 21:23set up your own stack
- 32:51start sandbox
- 34:35install this filter
- 41:50setting the maximum size of the data segment
- 43:24limit the address space
related talks
55mLinux Security APIs and the Chromium Sandbox
50mLinux Security and How Web Browser Sandboxes Really Work
01h 25mSandboxing a Linux Application
42mSandboxing a Linux application
34mLinux for Chromebooks: Secure Development
01h 02mSandboxing a Linux Application
38mSandboxing in Linux with zero lines of code
32mLinux user namespaces: a blessing and a curse