Striving for Developer-Centric Sandboxing

: Exploring Adoption, Usability, and Threadbox Sandboxing

Abstract

Sandboxes minimize the harm a security incident causes by limiting the resources programs can access, only granting them the needed permissions to function. There are sandboxing solutions that are primarily designed for developers, as they are exposed via APIs and can be integrated into code. The usability of security is essential, as unusable security APIs will not be adopted, or worse, will be misused. This work explores the field of sandboxing mechanisms (APIs) and addresses key unexplored areas, including adoption and usability.

We first explore the adoption of sandboxing mechanisms by examining software packages in four major operating systems for the use of different sandboxing mechanisms (Seccomp, Landlock, Pledge, Unveil, and Capsicum). We found that these mechanisms are used directly by fewer than 1% of the packages. The study showcases examples of sandboxed packages and compares how sandboxes are implemented across different operating systems.

To better understand how developers sandbox their code, we conducted a usability study on Seccomp with experienced developers, exploring how they approach sandboxing an application and the difficulties they face while doing so. The results illustrate that the developers' implementations of sandboxing were completely different, and also the ways they arrived at these solutions were different. We also addressed the usability of CHERI, a contemporary hardware architecture, that, contrary to Seccomp, requires developers to do little work to sandbox and secure their programs. The study shows that developers struggle with translating their understanding of CHERI’s concepts into technical solutions, and discusses many aspects that could hinder its~adoption.

Aided by the insights of these studies, we developed Threadbox, a sandboxing mechanism that is designed to provide modular sandboxing. We discuss the model of sandboxing functions, detail the technical design of Threadbox, and show how it fills many of the gaps presented by other mechanisms.

Date of Award	13 May 2025
Original language	English
Awarding Institution	University of Bristol
Supervisor	Gretch Hallett (Supervisor) & Daniel Page (Supervisor)