Location of Repository

Practical and effective sandboxing for non-root users

By Taesoo Kim and Nickolai Zeldovich

Abstract

MBOX is a lightweight sandboxing mechanism for nonroot users in commodity OSes. MBOX’s sandbox usage model executes a program in the sandbox and prevents the program from modifying the host filesystem by layering the sandbox filesystem on top of the host filesystem. At the end of program execution, the user can examine changes in the sandbox filesystem and selectively commit them back to the host filesystem. MBOX implements this by interposing on system calls and provides a variety of useful applications: installing system packages as a non-root user, running unknown binaries safely without network accesses, checkpointing the host filesystem instantly, and setting up a virtual development environment without special tools. Our performance evaluation shows that MBOX imposes CPU overheads of 0.1–45.2 % for various workloads. In this paper, we present MBOX’s design, efficient techniques for interposing on system calls, our experience avoiding common system call interposition pitfalls, and MBOX’s performance evaluation.

Year: 2013
OAI identifier: oai:CiteSeerX.psu:10.1.1.310.8085
Provided by: CiteSeerX
Download PDF:
Sorry, we are unable to provide the full text but you may find it at the following location(s):
  • http://citeseerx.ist.psu.edu/v... (external link)
  • http://people.csail.mit.edu/ni... (external link)
  • Suggested articles


    To submit an update or takedown request for this paper, please submit an Update/Correction/Removal Request.