Google Open Sources Sandboxing Tool
Written by Kay Ewbank   
Monday, 06 May 2019

Google has made its Sandboxed API tool open source. The tool can be used to create security policies for individual software libraries.

Sandboxed API is designed to get around the problem that developers are faced with then they need to process externally generated data that is potentially untrusted.

sandbox

The tool is designed to avoid security vulnerabilities such as  memory corruption bugs or problems related to the parsing logic such as path traversal issues. Finding a sandboxing tool that is highly resistant to attacks, protects the rest of the operating system, but is sufficiently easy-to-use, can be problematic. 

Google says its Sandboxed API is battle-tested, and makes it possible to create security policies for individual software libraries, while still being granular enough to protect the rest of used software infrastructure.

As Sandboxed API serves the purpose of accessing individual software functions inside a sandboxed library, Google is also making its core sandboxing project, Sandbox2, publicly available. This is now part of Sandboxed API and provides the underlying sandboxing primitives. It can be also used standalone to isolate arbitrary Linux processes.

Sandboxed API is currently implemented for software libraries written in C or providing C bindings. From a high-level perspective, Sandboxed API separates the library to be sandboxed and its callers into two separate OS processes: the host binary and the sandboxee. Actual library calls are then marshalled by an API object on the host side and send via interprocess communication to the sandboxee where an RPC stub unmarshals and forwards calls to the original library.

Users just need to provide a sandbox policy, a set of system calls that the underlying library is allowed to make, and the resources it is allowed to access and use. Once ready, a library based on sandboxed API can easily be reused in other projects.

sandbox

More Information

Sandboxed API

Related Articles

Google Bans Obfuscated Code - Who's To Judge?

Tink Library Helps You Develop Secure Code

Counting Vulnerabilities In Open Source Projects and Programming Languages

Don't Neglect Open Source Security

To be informed about new articles on I Programmer, sign up for our weekly newsletter, subscribe to the RSS feed and follow us on Twitter, Facebook or Linkedin.

Banner


Fei-Fei Li On Spatial Intelligence As The Next Frontier In AI
11/07/2025

Last month in front of an enthusiastic audience at Y Combinator, Fei-Fei Li, often called the godmother of AI, talked to Diana Hu about spatial intelligence and why she considers it the next crit [ ... ]



Why Drone Shows Are Booming
04/07/2025

What do you need to make a celebration noteworthy? You may automatically think fireworks, especially for Independence Day, but an increasing number of celebrations are turning to drone shows instead.& [ ... ]


More News

pico book

 

Comments




or email your comment to: comments@i-programmer.info

Last Updated ( Monday, 06 May 2019 )