quite simple sandbox header library
You can not select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
Albert S. dbdb35db37 Remove wrong static keywords from some qssb_*_policy functions 2 months ago
README.md updated README 7 months ago
qssb.h Remove wrong static keywords from some qssb_*_policy functions 2 months ago

README.md

qssb.h (quite simple sandbox)

qssb.h is a simple header only library that provides an interface to sandbox applications. Using Seccomp and Linux Namespaces for that purpose requires some knowledge of annoying details which this library aims to abstract away as much as possible.

Status

No release yet, API is unstable.

Features

Systemcall filtering, restricting file system access, dropping privileges, isolating the application from the network, etc.

Requirements

Kernel >=3.17 sys/capabilities.h header. Depending on your system, libcap might be needed for this.

FAQ

Does the process need to be priviliged to utilize the library?

No.

It doesn’t work on Debian!

You can thank a Debian-specific patch for that. In the future, the library may check against that. Execute echo 1 > /proc/sys/kernel/unprivileged_userns_clone to disable that patch for now.

Documentation

To be written

Examples

Real world project: cgit sandboxed: https://git.quitesimple.org/cgitsb

Contributing

Contributions are very welcome. Options:

  1. Pull-Request: github.com/quitesimpleorg/qssb
  2. Mail to qssb at quitesimple.org with instructions on where to pull the changes.
  3. Mailing a classic patch.

License

ISC