~/talk

Sandboxing a Linux application

on YouTube 42m
Talkat NDC TechTown 2021 · 2021-08-30..09-02· [security, linux-and-operating-systems]

speaker

name:Martin Ertsås
links:none on file

resources

video:https://youtu.be/SxK-hccyoTc
slides:none on file

summary

Walks through building a sandbox by composing Linux namespaces and seccomp filters: creates user namespaces and writes /proc/self/uid_map and setgroups to map a real uid to uid 0, uses pivot_root plus bind mounts to create a minimal root with only lib64 and the application, forks so the child becomes PID 1 inside a new pid namespace, and strips networking by moving interfaces or using veth pairs. Shows raw BPF seccomp is brittle and instead uses libseccomp for syscall and argument checks; mentions cgroups and SELinux and warns slide code omits error handling.

AI-written summary · about

chapters (10)

  1. 0:00Intro
  2. 1:36What is a sandbox
  3. 5:31namespaces
  4. 6:56uid namespace
  5. 11:22mount namespace
  6. 17:52get rid of processes
  7. 22:51Network namespace
  8. 26:35Other namespaces
  9. 29:24Writing filters
  10. 35:51Checking arguments

related talks

~/search
type to search 6,249 conferences, 138,987 speakers and 185,172 talks
~/help
cmdctrl k
search every conference, speaker and series
/
focus the filter search
h
home
c
conferences
s
speakers
e
series
t
light / dark — the status bar button does the same
?
this help
esc
close this, then clear every filter — or just the search, while you are typing in it

Ignored while you are typing. Pages without a filter rail have no search to focus.