Vx32: Lightweight User-level Sandboxing on the x86

11 years 10 months ago
Vx32: Lightweight User-level Sandboxing on the x86
Code sandboxing is useful for many purposes, but most sandboxing techniques require kernel modifications, do not completely isolate guest code, or incur substantial performance costs. Vx32 is a multipurpose user-level sandbox that enables any application to load and safely execute one or more guest plug-ins, confining each guest to a system call API controlled by the host application and to a restricted memory region within the host's address space. Vx32 runs guest code efficiently on several widespread operating systems without kernel extensions or special privileges; it protects the host program from both reads and writes by its guests; and it allows the host to restrict the instruction set available to guests. The key to vx32's combination of portability, flexibility, and efficiency is its use of x86 segmentation hardware to sandbox the guest's data accesses, along with a lightweight instruction translator to sandbox guest instructions. We evaluate vx32 using microbe...
Bryan Ford, Russ Cox
Added 02 Oct 2010
Updated 02 Oct 2010
Type Conference
Year 2008
Authors Bryan Ford, Russ Cox
Comments (0)