nl on Mbox – A lightweight sandboxing mechanism

Comment on Mbox – A lightweight sandboxing mechanism

Hmm. Seems very secure.. I can't run anything.

  ./configure
  make
   ./mbox ls

   Stop executing pid=20987: It's not allowed to call mmap on 0x400000

Same error no matter what executable I try. I'm assuming that isn't by design?

agateau 12y

I suspect (haven't checked!) this is actually Ubuntu kernel not allowing mbox to do what it tries to do. See https://wiki.ubuntu.com/SecurityTeam/Roadmap/KernelHardening

thiagoc 12y

Same error here, but `ls' works:

    ./mbox ls
    test
     > /tmp/sandbox-14587

    ./mbox -- wget google.com

    Stop executing pid=14629: It's not allowed to call mmap on 0x400000
    Sandbox Root:
     > /tmp/sandbox-14625

BTW, I'm on Arch:

    Linux colossus 3.12.9-2-ARCH #1 SMP PREEMPT Fri Jan 31 10:22:54 CET 2014 x86_64 GNU/Linux

joshbaptiste 12y

Same here regardless of the binary on two different Fedora/Debian nodes ..

nl 12y

Ubuntu 12.04 here.

Comments