基于多安全机制的Linux应用沙箱的设计与实现

Design and Implementation of Linux Application Sandbox Based on Multiple Security Mechanisms

文章设计了一个具有自己独立工作目录的Linux应用沙箱,可为用户对不信任的应用程序提供一个独立和安全的运行环境,应用程序在沙箱中所做的操作对主机不会造成任何影响。该沙箱提供了文件系统隔离、系统资源隔离、物理资源隔离、权能限制和强制访问控制(Mandatory Access Control,MAC)等策略,添加了地址随机化、不可执行页保护等内存保护安全策略。与已有沙箱对比,文章设计的沙箱增加了多种安全机制,提高了系统的安全性,保护了系统的数据安全和用户的个人隐私等。

Linux application sandbox is designed for providing an independent, secure operating environment for untrusted applications. The sandbox has its own independent working directory, and the operation of applications in the sandbox has no impact on the host. The sandbox provides iflesystem isolation, system resources isolation, physical resources isolation, capabilities limits and mandatory access control （MAC） policies, adding memory protection policies like address randomization and non-executable memory page protection. The sandbox increases several security mechanisms relative to existing sandboxes, improving the system security and protecting the system and user’s personal privacy.