Is there a lightweight, programmable Sandbox API for the Windows platform? [closed]

Closed. This question does not meet Stack Overflow guidelines. It is not currently accepting answers.

---

We don’t allow questions seeking recommendations for books, tools, software libraries, and more. You can edit the question开发者_如何学编程 so it can be answered with facts and citations.

Closed 4 years ago.

Improve this question

To run untrusted code at home I use a VMWare virtual machine. I want to find an alternate lightweight sandbox API for running untrusted applications, without the overhead of installing VMWare, or any other kind of end-user virtualization tool like that. (Edit: I don't want it to host an OS - I want it to run untrusted apps).

Ideally the sandbox would be (or could be made) transparent so the app running in the sandbox doesn't display any extra chrome or features. (Don't they do this in Parallels on the Mac)

The Windows .NET developer side of me wishes for an API so instead of booting up a special GUI, I can script scenarios for it.

It would be like how the Google Chrome web browser contains its own technology to sandbox scripts running from the Internet to protect the system. Google doesn't need to distribute VMWare with their browser and yet they achieve sandbox security for apps.

Edit:

Looking for something lightweight like Google Chrome contains with features like greatly restricted file/network/UI access, low privileges, etc. Not looking for running/hosting its own OS.

---

Google's Chrome is using 4 windows mechanisms to achieve this:

A restricted token
The Windows job object
The Windows desktop object
Windows Vista only: The integrity levels

Have a look at: https://sites.google.com/a/chromium.org/dev/developers/design-documents/sandbox

They have a detailed description of what they're doing.

---

No, there is not.

I mean, you can use a different Windows account (with whatever permissions you consider appropriate), but then you need to be comfortable that the untrusted app can't break out of that. But you do have that same problem with VMWare (it has had bugs in the past that let you break out). Best thing to do is run in a Virtual Machine.

---

You may also be interested in Google's Native Client (also known as NaCl). This is a project that aims to be able to run (verifiable) x86 code inside a sandbox.

---

I have not implemented this..but my $.02.

You can consider implementing a Windows station. A windows station is basically a security boundary to contain desktops and processes Only one Windows Station is permitted for Console Logon (Winsta0) http://msdn.microsoft.com/en-us/library/windows/desktop/ms682573(v=vs.85).aspx

You can achieve, process, Windows Object, and ACL Isolation on a per station basis. Some API functions used in Windows Station are listed here: http://msdn.microsoft.com/en-us/library/windows/desktop/ms687107(v=vs.85).aspx

An Overview of Sessions,Desktops and Windows Stations. http://blogs.technet.com/b/askperf/archive/2007/07/24/sessions-desktops-and-windows-stations.aspx

There is a CodeProject example here with source: http://www.codeproject.com/Articles/21352/Virtual-Desktop-A-Simple-Desktop-Management-Tool

I would recommend using API Monitor to debug Win32 API Calls http://www.rohitab.com/apimonitor

hth

---

You can use Invincea FreeSpace or the free Sandboxie. Not sure if any of them are scriptable or not.

These are called Containment applications, i.e., sandboxes. You can read about it here: https://www.fas.org/irp/congress/1997_hr/h970211gm.htm

---

In a "sandboxing" question of mine I was pointed to Sandboxie. I does not solve my problem at all but maybe it is interesting for you?

I don't know if it has an API but a quick google indicates that it is at least somehow automatable via command line.

---

Unfortunately, for Windows hosts your options are extremely limited. However, on Linux hosts, options such as mbox and capsicum are available which do what what you describe - i.e. lightweight, application level sandboxing.