Package: sandboxlib
This project is a total work in progress, no documentation yet.It is being developed as part of theBaserockproject.The goal of this library is to provide the sandboxing functionality that is
already present in the build toolsMorphandYBD. We want this new library
to be usable without depending onlinux-user-chroot, so that it can be used
on Mac OS X, and hopefully other platforms too.A longer term goal is to become a useful, generic, cross-platform tool for
running commands in an environment that is partially isolated from the host
system in some way.The library is implemented in Python currently. This is mostly because it is
an adaptation of existing Python code, not because of any desire to exclude
other languages. Maybe we could rewrite it as a C library with Python bindings.SANDBOXLIB DOES NOT GUARANTEE YOU ANY KIND OF SECURITY. Its main purpose is
for isolating software builds from the host system, to ensure that builds
are not contacting the network, or reading or writing files outside the build
environment.Current backendschroot: any POSIX OS, requires ‘root’ priviligeslinux-user-chroot: Linux-only, does not require ‘root’, requireslinux-user-chrootto be installed and setuid rootPossible future backendsSecurity Enhanced Linux(SELinux): seehttps://danwalsh.livejournal.com/28545.htmlsystemd-nspawnRelationship to other projectsSandboxinglibsandbox / pysandboxThelibsandboxlibrary is a Linux-specific implementation of process
sandboxing, which supports intercepting syscalls, calling setrlimit(),
and dropping certain privileges.PRootThePRoottool provids features similar tolinux-user-chroot, plus some
extra code to allow running programs for a different architecture using
virtualisation. The PRoot tool isdiscontinued.Sandstorm.ioSandstorm.ioaims to be a platform for running web applications on shared
infrastructure, with individual users in mind.It uses the ‘namespaces’ feature of Linux. Seehttps://github.com/sandstorm-io/sandstormfor more information.Sandstorm.iois for a specific use case of web application sandboxing, so it
doesn’t make sense for sandboxlib to wrap it. Use it directly if it suits your
purpose!seccompThe Linux kernel provides theseccompsyscall, which can be used in two ways.TheSECCOMP_SET_MODE_STRICToperation creates a very restrictive but secure
sandbox. Most programs wouldn’t work in this sandbox, but it does have some uses.
It isused by Google Chrome,
among other things.TheSECCOMP_SET_MODE_FILTERoperation allows blacklisting certain system
calls. This can be done in such a way that most existing programs work, but
certain obvious security holes in a sandbox are closed (for example, the
kexec() system call).xdg-app (GNOME Application Sandboxing)Thexdg-appproject started from a desire in theGNOMEdesktop project to
allow running 3rd-party applications with some isolation from the host system.
Mobile platforms like Android and iOS have been doing this for some time
already.It implements sandboxing mainly using the ‘namespaces’ feature of Linux.  Find
out more aboutthe projectandhow the sandboxing is implemented.xdg-appis for a specific use case of desktop application sandboxing, so it
doesn’t make sense for sandboxlib to wrap it. Use it directly if it suits your
purpose!Further readingSandboxing for multi-tenant applications(archived)StackOverflow question “Run an untrusted C program in a sandbox in Linux that prevents it from opening files, forking, etc.?StackOverflow question “How to “jail” a process without being root?ContainerisationThere is a lot of overlap between the topics of ‘containerisation’ and
‘sandboxing’. Many tools that work with ‘containers’ expect that containers
are long-lived things, where the ‘sandboxlib’ library treats a sandbox as a
much more lightweight, temporary thing.App Container specI have been using theApp Container specas a reference during development.
The scope of ‘sandboxlib’ is different to that of the App Container spec:
‘sandboxlib’ only deals with a single, isolated sandbox (which may or may
not be a ‘container’), where the App Container spec is focused on multiple
containers. However, ‘sandboxlib’ would be a useful building block for
implementing a complete App Container runtime, and simple App Container images
(.acis) should be runnable with therun-sandboxtool directly.Clear ContainersIntelare producing a Linux distribution namedClear Linux, as part of a project to develop what they callClear Containers. The idea is to make
virtualisation withQEMUfast enough and convenient enough to compete with
current containerisation software. All current containerisation systems use
kernel namespacing, which provide a much weaker security barrier than full
virtualisation.The implementation depends on Linux’sKVMfeature, plus patched versions ofQEMUand Linux.DockerDockerallows managing multiple prebuilt container systems. While itcan
support multiple platform-specific backendsfor running containers, I am only aware of Linux-specific backends at the time
of writing.schrootThe use case for theschroottool is ‘I want to define a contained
environment once, and use it many times.’ The ‘sandboxlib’ library is more
about dynamically creating sandboxes. Ifschrootsuits your needs, just
use it directly without any abstraction layer.Python-specific SandboxingThe ‘sandboxlib’ library is for sandboxinganyprogram, at the operating
system level.If you want to do language-level sandboxing (i.e. run untrusted Python code
within a larger Python program), there are some ways to do it.The concensus seems to be that Python language-level sandboxing is pretty much
impossible with the default ‘cpython’ Python runtime:https://mail.python.org/pipermail/python-dev/2013-November/130132.htmlhttps://programmers.stackexchange.com/questions/191623/best-practices-for-execution-of-untrusted-codeHowever, other Python runtimes do support language-level sandboxing.PyPyis one:https://pypy.readthedocs.org/en/latest/sandbox.htmlBuild toolsBazelTheBazelbuild tool contains aLinux-specific sandbox implementation.MorphTheMorphbuild tool (fromBaserock) is the original source of the
‘sandboxlib’ linux_user_chroot backend. Hopefully Morph will adopt the
‘sandboxlib’ library in future.YBDTheYBDbuild tool (fromBaserock)triggered the creation of the
‘sandboxlib’ library.LicenseLicense is GPLv2 but other licensing can be considered on requestMost of the copyright is currently Codethink but don’t let that put you off.
There’s no intent to keep this as a Codethink-only project, nor will there be
any attempt to get folks to sign a contributor agreement. Contributors retain
their own copyright.