Actions

sandbox-app-launcher - Sandboxed Application Launcher

From Whonix



Sandboxing123123.png

Introduction[edit]

sandbox-app-launcher is an application launcher that can start each application inside its own restrictive sandbox. It runs each application as its own user, within a bubblewrap sandbox and confined by AppArmor.

This launcher is geared towards end-user applications, not any system software. The directory /shared is shared across all application sandboxes to transfer files across.

This implements a permissions system to configure what applications can access. There are currently five available permissions:

  • network access;
  • webcam access;
  • microphone access;
  • shared storage access (read-only or read-write); and
  • dynamic native code execution.

All user-installed applications will be automatically configured to run in the sandbox and a prompt will ask which permissions should be granted to the application (not implemented yet).

The launcher is currently a work-in-progress and is not yet ready for actual use. To learn more, see:

Design[edit]

Bubblewrap allows developers to make use of namespaces [archive] and seccomp [archive]. All applications are run in mount, PID, cgroup and UTS namespaces; IPC namespaces are planned but are not currently implemented due to limitations in Xorg. Fine-grained filesystem restrictions are implemented via mount namespaces and AppArmor. Seccomp blocks certain syscalls which can greatly reduce kernel attack surface among other things.

All applications by default use a seccomp whitelist to block dangerous and unused syscalls [archive]. In addition, the arguments of some syscalls are filtered to:

  • Block unused socket address families [archive].
  • Block any dangerous or unused ioctls [archive] such as TIOCSTI (can be used in sandbox escapes), TIOCSETD (can increase kernel attack surface by loading vulnerable line disciplines), SIOCGIFHWADDR (can retrieve the user’s MAC address), etc.
  • Implement W^X [archive] (explained in detail further below).

Apparmor also gives fine-grained controls over IPC signals, D-Bus, UNIX sockets, ptrace and more.

Sandbox Escape Mitigation[edit]

Table: Sandboxed Application Launcher Mitigations

Sandbox Escape Vector Mitigation
D-Bus D-Bus [archive] is common avenue for sandbox escapes. [1] This attack vector is mitigated by denying access to the system bus and only allowing access to the session bus. This is safe since each application runs as their own user with their own session bus, ensuring no IPC [archive] between sandboxes.
Dynamic Native Code Execution Dynamic native code execution is generally a security issue since it allows an attacker to execute new arbitrary code. This is prevented by the following mechanisms:
  • Enforcing strict W^X in both memory and the filesystem.
  • Seccomp is used to prevent creation of memory mappings that are both writable and executable and transitioning a writable memory mapping to executable.
  • AppArmor is used to prevent execution of programs from writable directories.

These mechanisms force attackers to utilize the already existing code (e.g. Return-oriented programming (ROP) [archive] / Jump-Oriented-Programming (JOP) [archive]) which is much more limited and difficult. The main things that legitimately require this are JIT engines in browsers.

Malware Persistence The only places malware can persist inside the sandbox are the home directory or shared storage (if enabled as read-write) and it can only ever be executed if W^X is disabled. Everything else is mounted read-only or as a tmpfs [archive] (a file system which keeps all files in virtual memory).
PulseAudio PulseAudio [archive] was also not written with isolation in mind [2] so access to it is blacklisted from within the sandbox. By default this will break a lot of things so a more robust solution like PipeWire [archive] may be used in the future.
Separate User per Sandboxed Application This approach provides a higher security threshold: [3]

Sandboxing programs running as the same user has historically, never seriously worked well. It’s been the cause of many issues with e.g. Flatpak. It’s why Android/iOS have always used separate users.

X11 X11 [archive] does not have GUI isolation [4] so it is trivial to escape sandboxes with it. There is no protection against this vector at present, but the plan is to either switch to Wayland [5] or use a nested X11 server like Xpra.

Installation[edit]

Install sandbox-app-launcher.

1. Update the package lists.

sudo apt-get update

2. Upgrade the system.

sudo apt-get dist-upgrade

3. Install the sandbox-app-launcher package.

Using apt-get command line parameter --no-install-recommends is in most cases optional.

sudo apt-get install --no-install-recommends sandbox-app-launcher

The procedure of installing sandbox-app-launcher is complete.

Usage[edit]

TODO

Development Discussion[edit]

https://forums.whonix.org/t/system-wide-sandboxing-framework-sandbox-app-launcher/9008 [archive]

References[edit]



Fosshost is sponsors Kicksecure ™ stage server Whonix old logo.png
Fosshost About Advertisements

Search engines: YaCy | Qwant | ecosia | MetaGer | peekier | Whonix ™ Wiki


Follow: 1024px-Telegram 2019 Logo.svg.png Iconfinder Apple Mail 2697658.png Twitter.png Facebook.png Rss.png Reddit.jpg 200px-Mastodon Logotype (Simple).svg.png

Support: 1024px-Telegram 2019 Logo.svg.png Discourse logo.png Matrix logo.svg.png

Donate: Donate Bank Wire Paypal Bitcoin accepted here Monero accepted here Contriute

Whonix donate bitcoin.png Monero donate Whonix.png United Federation of Planets 1000px.png

Twitter-share-button.png Facebook-share-button.png Telegram-share.png Iconfinder Apple Mail 2697658.png Reddit.jpg Hacker.news.jpg 200px-Mastodon Logotype (Simple).svg.png

Please help in testing new features and bug fixes in Whonix ™.

https link onion link Priority Support | Investors | Professional Support

Whonix | © ENCRYPTED SUPPORT LP | Heckert gnu.big.png Freedom Software / Osi standard logo 0.png Open Source (Why?)

The personal opinions of moderators or contributors to the Whonix ™ project do not represent the project as a whole.

By using our website, you acknowledge that you have read, understood and agreed to our Privacy Policy, Cookie Policy, Terms of Service, and E-Sign Consent.