Playing in the Sandbox: A Study on the Usability of Seccomp
summary
Study recruits 7 experienced Seccomp developers after six months of hunting and asks them to sandbox a small app; 6 of 7 produce working sandboxes using strace-driven allowlisting, plus one using a homemade header, others consulting man pages, Stack Overflow or ChatGPT. Several sandboxes end up overprivileged because full startup and loader syscalls are whitelisted (ChatGPT and naive full-whitelist approaches cause extra permissions). Conclusion: seccomp is powerful but too low-level; developers want higher-level, use-case driven abstractions like pledge/unveil.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 1:13Sandboxing with seccomp
- 2:58Developers approach sandboxing
- 5:26System call struggles
- 7:53Usability frustrations
- 8:55Seccomp limitations
- 10:02Sandboxing alternatives
- 10:43Summary
related talks
42mSandboxing a Linux application
38mSandboxing in Linux with zero lines of code
43mSandboxes, Seccomp, and Syscalls: Chasing Isolation in Kubernetes (Mark Manning)
44mSeccomp for Developers - Making Applications Simply More Secure
01h 25mSandboxing a Linux Application
36mSeccomp For Developers - Writing More Secure Applications
34mSeccomp: What Can It Do For You?
35mEnter Sandbox