Practical and Effective Sandboxing for Non-root Users
نویسندگان
چکیده
MBOX is a lightweight sandboxing mechanism for nonroot users in commodity OSes. MBOX’s sandbox usage model executes a program in the sandbox and prevents the program from modifying the host filesystem by layering the sandbox filesystem on top of the host filesystem. At the end of program execution, the user can examine changes in the sandbox filesystem and selectively commit them back to the host filesystem. MBOX implements this by interposing on system calls and provides a variety of useful applications: installing system packages as a non-root user, running unknown binaries safely without network accesses, checkpointing the host filesystem instantly, and setting up a virtual development environment without special tools. Our performance evaluation shows that MBOX imposes CPU overheads of 0.1–45.2% for various workloads. In this paper, we present MBOX’s design, efficient techniques for interposing on system calls, our experience avoiding common system call interposition pitfalls, and MBOX’s performance evaluation.
منابع مشابه
An invariant framework for conducting reproducible computational science
Computational reproducibility depends on the ability to not only isolate necessary and sufficient computational artifacts but also to preserve those artifacts for later re-execution. Both isolation and preservation present challenges in large part due to the complexity of existing software and systems as well as the implicit dependencies, resource distribution, and shifting compatibility of sys...
متن کاملFlexible and Efficient Sandboxing Based on Fine-Grained Protection Domains
Sandboxing is one of the most promising technologies for safely executing potentially malicious applications, and it is becoming an indispensable functionality of modern computer systems. Nevertheless, traditional operating systems provide no special support for sandboxing; a sandbox system is either built in the user level, or directly encoded in the kernel level. In the user-level implementat...
متن کاملMeasuring user's emotional experience in two tools using an integrated method based on task analysis
Background and Objectives: Human factors are critical in the research and development of various products, but the wideness and unclarity of different aspects of these factors make it difficult to extract the demands of users. Studying emotional aspects of users' behavior with respect to products, as well as interviewing them, is considered an efficient tool for extracting design demands. Me...
متن کاملStatic Binary Analysis And Transformation For Sandboxing Untrusted Plugins
of the Thesis Static Binary Analysis And Transformation For Sandboxing Untrusted Plugins by Prateek Saxena Master of Science in Computer Science Stony Brook University 2007 Computers today have become a integral part of daily activities for users who rely on them as means of communication, financial management, entertainment, and business. Moreover, users today are depending increasingly on off...
متن کامل"No Good Reason to Remove Features" - Expert Users Value Useful Apps over Secure Ones
Application sandboxes are an essential security mechanism to contain malware. Yet, they are seldom used on Desktops. We hypothesise this is because sandboxes are incompatible with plugins, and with APIs used to implement a wide variety of Desktop features. To verify this, we interviewed 13 expert users about their app appropriation decisions, and illustrate how they recruit values like usefulne...
متن کامل