Alex Rivera | Logout

Is there a lightweight, programmable Sandbox API for the Windows platform?

Asked 2010-01-06T22:20:59.670
13

To run untrusted code at home I use a VMWare virtual machine. I want to find an alternate lightweight sandbox API for running untrusted applications, without the overhead of installing VMWare, or any other kind of end-user virtualization tool like that. (Edit: I don't want it to host an OS - I want it to run untrusted apps).

Ideally the sandbox would be (or could be made) transparent so the app running in the sandbox doesn't display any extra chrome or features. (Don't they do this in Parallels on the Mac)

The Windows .NET developer side of me wishes for an API so instead of booting up a special GUI, I can script scenarios for it.

It would be like how the Google Chrome web browser contains its own technology to sandbox scripts running from the Internet to protect the system. Google doesn't need to distribute VMWare with their browser and yet they achieve sandbox security for apps.

Edit:

Looking for something lightweight like Google Chrome contains with features like greatly restricted file/network/UI access, low privileges, etc. Not looking for running/hosting its own OS.

Edit
Report

1 Answer

7

Google's Chrome is using 4 windows mechanisms to achieve this:

A restricted token
The Windows job object
The Windows desktop object
Windows Vista only: The integrity levels

Have a look at: https://sites.google.com/a/chromium.org/dev/developers/design-documents/sandbox

They have a detailed description of what they're doing.

answered 2011-02-02T00:46:09.693

Your Answer