Hacker Newsnew | past | comments | ask | show | jobs | submitlogin
Using Capsicum For Sandboxing (links.org)
16 points by there on April 28, 2012 | hide | past | favorite | 3 comments


I wonder how this (seemingly fragile) setup of forking and juggling globals compares to a ptrace-based sandbox on Linux.

It's quite easy to fork a child, ptrace it, and have the child execve the actual program you'd like to sandbox.


ptrace is dog slow.


You'd only incur any sort of performance penalty when doing a syscall though. This article talks about sandboxing something like bzip2, which would do a few syscalls on startup and from there on only for I/O. Most of the execution time is spent doing computation, which wouldn't be affected by ptrace's performance overhead.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: