Using Capsicum For Sandboxing(links.org)

16 pointsby there14 lat temu3 comments

http://www.links.org/?p=1242

3 comments

I wonder how this (seemingly fragile) setup of forking and juggling globals compares to a ptrace-based sandbox on Linux.

It's quite easy to fork a child, ptrace it, and have the child execve the actual program you'd like to sandbox.

nwmcsween14 lat temu

ptrace is dog slow.

charliesome14 lat temu

You'd only incur any sort of performance penalty when doing a syscall though. This article talks about sandboxing something like bzip2, which would do a few syscalls on startup and from there on only for I/O. Most of the execution time is spent doing computation, which wouldn't be affected by ptrace's performance overhead.