CapExec: Towards Transparently-Sandboxed Services (Extended Version)

TL;DR

CapExec introduces a novel process supervisor that enables transparent sandboxing of network services via service declarations, leveraging Capsicum for robust security without application modifications.

Contribution

It presents CapExec, a service manager-based sandboxing approach that confines network services using Capsicum, avoiding invasive code changes and enabling widespread deployment.

Findings

Provides robust sandboxing without application modifications

Utilizes Capsicum framework for compartmentalization

Facilitates sandboxing at the service manager level

Abstract

Network services are among the riskiest programs executed by production systems. Such services execute large quantities of complex code and process data from arbitrary and untrusted network sources, often with high levels of system privilege. It is desirable to confine system services to a least-privileged environment so that the potential damage from a malicious attacker can be limited, but existing mechanisms for sandboxing services require invasive and system-specific code changes and are insufficient to confine broad classes of network services. Rather than sandboxing one service at a time, we propose that the best place to add sandboxing to network services is in the service manager that starts those services. As a first step towards this vision, we propose CapExec, a process supervisor that can execute a single service within a sandbox based on a service declaration file in which, required resources whose limited access to are supported by Caper services, are specified. Using the Capsicum compartmentalization framework and its Casper service framework, CapExec provides robust application sandboxing without requiring any modifications to the application itself. We believe that this is a first step towards ubiquitous sandboxing of network services without the costs of virtualization. Keywords: application security, sandboxing, service manager, Capsicum, compartmentalization