Sandboxing Adoption in Open Source Ecosystems

arXiv:2405.06447v1 Announce Type: cross
Abstract: Sandboxing mechanisms allow developers to limit how much access applications have to resources, following the least-privilege principle. However, it's not clear how much and in what ways developers are using these mechanisms. This study looks at the use of Seccomp, Landlock, Capsicum, Pledge, and Unveil in all packages of four open-source operating systems. We found that less than 1% of packages directly use these mechanisms, but many more indirectly use them. Examining how developers apply …

access adoption applications arxiv clear cs.cr cs.se developers ecosystems limit open source packages pledge privilege resources sandboxing seccomp study