Capsicum: Practical Capabilities for UNIX

Some background on Capsicum, from [link] Capsicum is a lightweight OS capability and sandbox framework developed at the University of Cambridge Computer Laboratory, supported by a grant from Google. Capsicum extends the POSIX API, providing several new OS primitives to support object-capability security on UNIX-like operating systems: * capabilities - refined file descriptors with fine-grained rights * capability mode - process sandboxes that deny access to global namespaces * process descriptors - capability-centric process ID replacement * anonymous shared memory objects - an extension to the POSIX shared memory API to support anonymous swap objects associated with file descriptors (capabilities) * rtld-elf-cap - modified ELF run-time linker to construct sandboxed applications * libcapsicum - library to create and use capabilities and sandboxed components * libuserangel - library allowing sandboxed applications or components to interact with user angels, such as Power Boxes. * chromium-capsicum - a version of Google's Chromium web browser that uses capability mode and capabilities to provide effective sandboxing of high-risk web page rendering. There's also a video of Robert Watson's 2010 Capsicum talk at [this video] Edited to add: The FreeBSD Foundation plans to significantly increase spending on projects (such as this one) as well as full-time staff members in 2013: [link]

> Sounds like a good use case for SELinux kinda, although you could implement sandboxing with SELinux it's going to take much more effort. SELinux is a Mandatory Access Control Framework and Capsicum is a hybrid Unix capabilities system. While there is overlap in what you can do with them they really our different sets of tools. Mandatory access controls are for system administrators to lock down and control access on a machine. Capsicum is for application authors to sandbox their application. Ideally they should be used together. Back to my point that while MAC(SELinux) can be used for sandboxing but will take more effort then using something like capsicum or pledge. With MAC you have to think of all the things you don't want an application to do. With Capsicum or Pledge you only have to think of the things you want your application to do and everything else will be blocked automatically. So for example to sandbox chromium with capsicum it took 100 LOC, to sandbox chromium with SELinux it took 200 LOC so not bad but it doesn't stop IPC primitives. So half the code and more protection. [1]: [this video]