沙盒 (電腦安全)









Disambig gray.svg  本條目介紹的是一种电脑安全机制。關於一种软件开发中的测试环境，請見“沙盒 (软件开发)”。

在计算机安全領域，沙盒（英语：sandbox，又譯為沙箱）是一種安全機制，為執行中的程式提供的隔離環境。通常是作为一些来源不可信、具破坏力或无法判定程序意图的程序提供实验之用[1]。


沙盒通常严格控制其中的程序所能访问的资源，比如，沙盒可以提供用后即回收的磁盘及内存空间。在沙盒中，网络访问、对真实系统的访问、对输入设备的读取通常被禁止或是严格限制。从这个角度来说，沙盒属于虚拟化的一种。


沙盒中的所有改动对操作系统不会造成任何损失。通常，这种技术被计算机技术人员广泛用于测试可能带毒的程序或是其他的恶意代码[2]。




目录






  • 1 具体实现


  • 2 參見


  • 3 参考来源


  • 4 外部链接





具体实现


沙盒将软件运行于一个受限的系统环境中，控制程序可使用的资源（如文件描述符、内存、磁盘空间等）[3]。


以下是一些沙盒的具体实现：




  • 软件监狱（Jail）：限制网络访问、受限的文件系统命名空间。软件监狱最常用于虚拟主机上[4]。

  • 基于规则的执行：通过系统安全机制，按照一系列预设规则给用户及程序分配一定的访问权限，完全控制程序的启动、代码注入及网络访问[5]。也可控制程序对于文件、注册表的访问。在这样的环境中，病毒木马感染系统的几率将会减小。Linux中，安全增强式Linux和AppArmor正使用了这种策略。


  • 虚拟机：模拟一个完整的宿主系统，可以如运行于真实硬件一般运行虚拟的操作系统（客户系统）。客户系统只能通过模拟器访问宿主的资源，因此可算作一种沙盒。

  • 主机本地沙盒：安全研究人员十分依赖沙盒技术来分析恶意软件的行为。通过创建一个模拟真实桌面的环境，研究人员就能够观察恶意软件是如何感染一台主机的。若干恶意软件分析服务使用了沙盒技术[6]。


  • 在线判题系统：用于编程竞赛中的程序测试。


  • 安全计算模式（seccomp）（英语：seccomp）：Linux内核内置的一个沙盒。启用后，seccomp仅允许write()、read()、exit()和sigreturn()这几个系统调用。



參見



  • chroot

  • 虛擬系統

  • Sandboxie



参考来源





  1. ^ Ian Goldberg, David Wagner, Randi Thomas, and Eric Brewer. A Secure Environment for Untrusted Helper Applications (Confining the Wily Hacker) (PDF). Proceedings of the Sixth USENIX UNIX Security Symposium. 1996 [25 October 2011]. 


  2. ^ Geier, Eric. How to Keep Your PC Safe With Sandboxing. TechHive. 2012-01-16 [2014-07-03]. 


  3. ^ Sandboxing Applications (PDF). 2001 [7 May 2013]. 


  4. ^ Auto-Sandboxing secure system. [2015-01-30]. 


  5. ^ Computer System Security and Access Controls. 1991 [17 May 2013]. （原始内容存档于2013年5月28日）. 


  6. ^ Native Client Sandbox – Untrusted x86 Native Code (PDF). [2015-01-03]. 




外部链接



  • Security In-Depth for Linux Software: Preventing and Mitigating Security Bugs

  • Sandbox – The Chromium Projects




-

Popular posts from this blog

Daylamites

Image
Map showing Daylam in western Tabaristan. The Daylamites or Dailamites (Middle Persian: Daylamīgān ; Persian: دیلمیان ‎ Deylamiyān ) were an Iranian people inhabiting the Daylam—the mountainous regions of northern Iran on the southern shore of the Caspian Sea. [1] They were employed as soldiers from the time of the Sasanian Empire, and long resisted the Muslim conquest of Persia and subsequent Islamization. In the 930s, the Daylamite Buyid dynasty emerged and managed to gain control over much of modern-day Iran, which it held until the coming of the Seljuq Turks in the mid-11th century. Contents 1 Origins, language and equipment 2 History 2.1 Pre-Islamic period 2.1.1 Seleucid and Parthian period 2.1.2 Sasanian period 2.2 Islamic period 2.2.1 Resistance to the Arabs 2.2.2 The Daylamite expansion 3 Culture 3.1 Names 3.2 Religion 3.3 Customs, equipment and appearance 4 References 5 Sources Origins, langu...
Read more

Czechs

Image
Czechs Češi Flag of the Czech Republic Total population c.   10–12 million Regions with significant populations   Czech Republic    6,732,104 [1] [nb 1] – 9 246 784 [2] Significant diasporic populations in:   United States 1,462,000 [3]   Canada 94,805 [4]   Germany 60,000   Israel 50,000   Argentina 45,000   United Kingdom 45,000 [5]   Austria 40,324 [6]   Italy 40,000   France 38,000   Slovakia 30,367 [7]   Australia 21,196 [8]    Switzerland 20,000   Croatia 9,641 (2011)   Chile 8,600   Ukraine 11,000   Sweden 7,175 (2001)   Ireland 5,451 [9]   Spain 5,622 (2006)   Russia 5,000–6,000   Netherlands 3,500   Romania 3,339 (2002)   Poland 3,000   South Africa 2,300   Mexico 2,000   Venezuela 2,000   Serbia 1,824 (2011) [10]   Colombia 1,200   New Zealand 1,083   Kazakhstan 1,000 [11]   Bo...
Read more

Lambaréné

Image
Place in Moyen-Ogooué, Gabon Lambaréné Street in Lambaréné Lambaréné Location in Gabon Coordinates: 0°41′18″S 10°13′55″E  /  0.68833°S 10.23194°E  / -0.68833; 10.23194 Coordinates: 0°41′18″S 10°13′55″E  /  0.68833°S 10.23194°E  / -0.68833; 10.23194 Country   Gabon Province Moyen-Ogooué Population (2013 census)  • Total 38,775 Lambaréné is a town and the capital of Moyen-Ogooué in Gabon. With a population of 38,775 as of 2013, it is located 75 kilometres south of the equator. Lambaréné is based in the Central African Rainforest at the river Ogooué. This river divides the city into 3 districts: Rive Gauche, Ile Lambaréné and Rive Droite. The Albert Schweitzer Hospital and the districts Adouma and Abongo are located on Rive Droite. The districts Atongowanga, Sahoty, Dakar, Grand Village, Château, Lalala and Bordamur build the Ile Lambaréné. The majority of the people in Lambaréné live in the district Isaac located on Rive Gauche. This distr...
Read more