Slashdot Mirror

← Back to Stories (view on slashdot.org)

A Highly Portable Sandbox Facility For OpenBSD

Posted by timothy on from the hey-you-kids-can't-go-in-there dept.

An Anonymous Coward writes: "A new facility called 'systrace' has been developed by one of the OpenBSD developers. It allows enforcement of system call policies on untrusted binaries. For now it is only available OpenBSD-current, but the author claims it is highly portable and can easily be integrated into GNU/Linux systems. Eventually binary-only software is going to become more and more common in Linux, so this could be a another 'Good Thing(TM)' from the paranoids that brought us OpenSSH."

2 of 40 comments (clear)

  1. Great news! by Lomby · · Score: 2, Interesting

    This is really a great advacement for security. I hope it will be ported to Linux as soon as possible.

    With this mechanism, basically every program can be sandboxed. Basically it would be very useful to restrict the access to the filesystem: applications do not need to access certain directories, or even better they should only access /home and /tmp.

    Still the permissions should be defined mainly at system level: for example the mozilla binary must not be allowed to access /etc or /sbin for any user.

  2. How does this compare to Jail? by Anonymous Coward · · Score: 2, Interesting

    Does this isolate the programs from each other like Jail in FreeBSD or is it more of a system protection?

    I've messed around with jail in FreeBSD and see there is a porting to Linux. Nice to see this in OpenBSD. Hey Microsoft, what have you got?