Want to learn about Sandboxing [closed]

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or expertise, but this question will likely solicit debate, arguments, po开发者_JAVA百科lling, or extended discussion. If you feel that this question can be improved and possibly reopened, visit the help center for guidance. Closed 10 years ago.

I want to learn more about sandboxing. Not just about it. I want to learn such that I will be able to write a simple sandbox.

Surprisingly, there isn't any information available anywhere. Even the Wikipedia article is not good.

Can any one please suggest me good material. I know that its very advanced level concept. So, what are the prerequisites for learning & mastering it.

---

read about API hooking, for example sandboxie hooks Windows kernel to filter all api calls to filesystem and redirects it results to sandbox, you could hook APIs and filter it, pass only valid parameters, return errors for invalid calls

for API hooking you will find plenty materials on the net, try on codeproject.com

---

Google's Chromium uses sandboxing and has several documents about it:

• http://dev.chromium.org/developers/design-documents/sandbox
• http://code.google.com/p/chromium/wiki/LinuxSandboxing

---

You might also look at jails in FreeBSD. These are the FreeBSD equivalent of sandboxes.

The source code for jail is available (though you'll have to understand the rest of the FreeBSD code as well.)

---

A simple sandbox would simply be an environment in which you let 'something' execute, but restrict what it can do.

Typically, this "something" is an already-existing language, like Java, or JavaScript, or C#, or native code. Java has 'sandboxing' apis for applets and so on, and .NET has various 'trust' levels, JavaScript has the bounds placed on it by the interpreters (browsers).

So it's a little weird to "write" your own sandbox unless you also have a language you want to sandbox.

Do you have such a language? What do you want to learn about, specifically?

---

This is very dependent on what do you want to sandbox. If it is a full-blown system with multiple interfaces/languages available, you really do not want to re-invent the wheel, but run a virtual machine in VirtualBox, QEmu or some other alternative

In any case, a sandbox IS, at least on some level a virtualization of the system you are 'supposed to be' running...

If you need to sandbox applications for a single (interpreted) language, modifying the interpreter sound like a sensible approach.

---

The answer will likely be language specific. Unfortunately most languages don't have built-in sandboxing capabilities. But functional languages tend to be powerful enough that one can be built from scratch without extending the language.

In Tcl the basic mechanism is to create slave interpreters:

interp create -safe sandbox
interp eval sandbox $set_up_code
set result [interp eval sandbox $unsafe_code]

---

I wrote an overview of the ways of sandboxing within Linux the other day, which links to a lot of references for the different techniques. Similar methods are applicable in other operating systems. I hope it is helpful - I couldn't find much comprehensively documented either.