Oblivious Sandboxing with Capsicum

Security is of paramount importance. Capsicum sticks to it principles, but is finite, this project aims on making it more widely applicable.

Currently only simple applications can run in the oblivious sandbox provided by capsh. This project will aim upon improving the wrapper system(libpreopen, capsh etc) and make applications work in an oblivious sandbox wherein applications will work in the sandbox without being modified or being known of, but this project will specifically focus on file(1) and Clang.

Moreover, capsh needs to be worked upon such that it becomes aware of the presence of libpreopen and understand the minimal set of resources it needs to preopen, provided by the user implicitly in the form of arguments or defined in a policy file.

The existing libpreopen and capsh code will provide a basis for understanding and improving the wrapper system based on the applications i.e file(1) and Clang chosen to sandbox obliviously.