基于多安全机制的轻量级Linux沙箱设计与实现

Design and Implementation of Lightweight Linux Sandbox Based on Multi-security Mechanism

在Linux环境设计与实现一款轻量级的安全沙箱,在占用资源少、损失较小的基础上实现对程序的安全控制访问。使用Linux内核Seccomp提供的安全性API接口,结合白名单、权限控制等多种安全机制,仅允许使用常见的非高危性系统调用,可限制程序运行时的时间和内存占用,以免产生恶意占用系统资源的行为。通过对沙箱进行安全程序和不安全程序的对比测试,结果证明,该设计能阻止危险程序的运行,并且额外开销不大,可满足实际需求。

A lightweight security sandbox is designed and implemented in the Linux environment,it can control the access of the program safely on the basis of less resource and less loss.Using the security API interface provided by Seccomp in Linux kernel,combined with a variety of security mechanisms such as white list mechanism and permission control mechanism,only common non-high-risk system calls are allowed,and high-risk system calls are limited to use in the program.Also,it can limit the time and memory occupation of program runtime to avoid malicious occupation of system resources.Through the experiment,the sandbox is tested by comparing the security program and the unsafe program.The results show that the design can prevent the dangerous program from running,and the extra cost is small,which can meet the actual needs.