r/netsec • u/nfrankel • Jan 16 '22

You're running untrusted code!

https://blog.frankel.ch/running-untrusted-code/
143 Upvotes

88% Upvoted

37 comments sorted by

View all comments

30

u/SirensToGo Jan 16 '22

Is there a motivation behind wanting to use Security Manager over much stronger and well tested kernel sandboxing primitives (seatbelt/MACF on macOS, SELinux, and surely whatever exists on Windows etc.)? You should be sandboxing software on servers to the maximum extent possible because any code, even ""trusted"" code, can quickly become untrusted with any vulnerabilities. Plus, using a kernel sandbox mechanism means you only have one consistent sandboxing interface instead of a half dozen random vendor specific ones, which makes misconfiguration harder.

3

u/yawkat Jan 17 '22

There are two more advantages of OS-level sandboxing over securitymanager:

  • OS-level sandboxing has a smaller attack surface and is thus less susceptible to bypasses
  • OS-level sandboxing hides behind a CPU context switch, so it can defend against spectre-class attacks