Chrome Seccomp-BPF Sandbox

Chrome://sandbox has gotten an update reflecting the newly implemented Mode 2 Seccomp Filters implemented through the Berkley Packet Filter (BPF). To learn more about Syscall and Seccomp Filtering you can read this post and learn about how Chrome’s new sandbox on Linux. Chrome’s seccomp sandbox is a powerful restriction on how Chrome can interact with the […]

Seccomp Mode 2 Filters

Just a short post to bring attention to seccomp mode 2 filters. There is not enough hype about this, probably because it’s not in the vanilla kernel yet (that I know of.) Seccomp filters let programs whitelist calls that they can make to the kernel. Whitelisting syscalls reduces kernel attack surface, which will prevent privilege […]

Writing Sandboxed Software

I’ve written a series of articles on various Linux sandboxing capabilities that developers can make use of to write their programs in a more secure fashion. If you’re interested, have a look. Here’s a link to all of the articles: Seccomp Filters: Linux Capabilities: Chroot Sandbox: Apparmor: And here’s a link […]

Sandboxing: Conclusion

In total I’ve written five methods for sandboxing code. These are certainly not the only methods but they’re mostly simple to use, and they’re what I’ve personally used. A large part of this sandboxing was only possible because I built the code to work this way. I split everything into privileged and unprivileged groups, and […]

Sandboxing: Apparmor

Sandboxing: Apparmor This is the fifth installment on a series of various sandboxing techniques that I’ve used in my own code to restrict an applications capabilities. You can find a shorter overview of these techniques here. This article will be discussing sandboxing with Apparmor. Mandatory Access Control: Mandatory Access Control (MAC), like Discretionary Access Control […]