Introduction

In this post, we will talk about sandbox. Researchers who work and study software exploitation probably know the concept. When properly implemented on a system, this kind of feature makes it harder to compromise the system. On Wikipedia, we have a good description of the concept:

“In computer security, a sandbox is a security mechanism for separating running programs. It is often used to execute untested code, or untrusted programs from unverified third parties, suppliers, untrusted users and untrusted websites. A sandbox typically provides a tightly controlled set of resources for guest programs to run in, such as scratch space on disk and memory. Network access, the ability to inspect the host system or read from input devices are usually disallowed or heavily restricted.”

The sandbox is a security mechanism that separates processes. Basically, we have a process with least privileges (target) and another process with greater privileges (broker). If the process with least privileges needs to execute an operation that is not allowed, a request is sent to the broker. Then, the broker checks whether the operation is allowed to be executed. If so, it executes, acknowledges the execution and returns a value to the target when needed. Sandboxes is used to protect the application and can also be used to provide a restricted and safe environment for execution and testing of malicious binaries. As an example, the Cuckoo Sandbox that is used for malware analysis.

In this post, we will talk about Capsicum [1]. It is a sandbox technology developed by the University of Cambridge. Capsicum support has already being implemented for several popular commands in the FreeBSD operating system, such as tcpdump [2], hastd, dhclient, kdump and sshd [3]. The experimental version was developed for FreeBSD [5] and was available since version 9.0. This sandbox adds two new features to the system, capability mode and capabilities.

Continue reading “Playing with Sandbox: An analysis of Capsicum”