musec/capsh

Capability-oriented shell

capsh

The capability-aware shell starts applications from inside Capsicum's capability mode. This allows for untrusted applications to be sandboxed from inception.

Note: currently, this software only works on a version of FreeBSD that supports direct execution of ld-elf.so.1 with an explicit file descriptor argument, i.e., 12-CURRENT post-r318431.

Build it:

1. Download, build and install libpreopen
2. Build capsh with CMake and (optionally) Ninja:

   $ git clone https://github.com/musec/capsh
   $ cd capsh
   $ mkdir build
   $ cd build
   $ cmake -G Ninja ..    # or leave out Ninja to generate Makefiles
   $ ninja                # or make, or gmake

Use it:

Currently, capsh can only do one thing: execute a single binary, specified by absolute path, from within a Capsicum sandbox. Also, the binaries it can execute aren't very interesting (we aren't really leveraging much of libpreopen yet), so you may have to content yourself with:

$ ./src/capsh /bin/echo "hi"
hi

capsh's Issues

Policy files

We need a mechanism to specify what things a program should always be able to access (e.g., where a compiler will find header files).

Resource integration?

While we're thinking about how to execute applications within sandboxes with security constraints, we might think about how to integrate resource constraints as well.

This will probably depend on #3 (policy files).

Create libsandbox

Once we've explored the values that need to go into sandboxes, we should wrap up in the work with a generic libsandbox (which may require a new name, as openjudge/sandbox is unfortunately taken — and it doesn't provide the security properties that it claims).

Pre-open files named at command line

When the user gives a command like cat foo bar, we should try to pre-open foo and bar and pass them into the sandbox (probably read-only by default).

RTLD changes?

Create simple test

We should have an llvm-lit-based unit test framework. The first test could simply run capsh echo "hi" and ensure that it outputs hi.

Integrate libpreopen

Now that libpreopen can pass its data around through shared memory (musec/libpreopen@7768034), we should integrate it into capsh for generically passing files into sandboxes.

confusion between this capsh and Linux capsh

Linux has a capsh for Linux capabilities - see http://man7.org/linux/man-pages/man1/capsh.1.html

Launch cat from capsh