Capsicum: Practical Capabilities for UNIX
Why Hacker News recommends it
Referenced as the authoritative talk on Capsicum, including comparisons of how little code it takes to sandbox programs versus SELinux.
What it is
Robert Watson presents the Capsicum paper at USENIX Security 2010, describing practical capability-based sandboxing for UNIX. The paper won Best Student Paper.
Recommended by 0 HN commenters across 0 different months, 2013 to 2017.
What Hacker News said
Cites emaste · 2013-04 · on “FreeBSD Foundation Announces Capsicum Framework Project”
Some background on Capsicum, from [LINK] Capsicum is a lightweight OS capability and sandbox framework developed at the University of Cambridge Computer Laboratory, supported by a grant from Google. Capsicum extends the POSIX API, providing several new OS primitives to support object-capability security on UNIX-like operating systems: * capabilities - refined file descriptors with fine-grained rights * capability mode - process sandboxes that deny access to global namespaces * process descriptors - capability-centric process ID replacement * anonymous shared memory objects - an extension to the POSIX shared memory API to support anonymous swap objects associated with file descriptors (capabi
Cites X86BSD · 2016-12 · on “Show HN: FSSB – A filesystem sandbox for Linux”
I can't even tell what this does. I just woke up but is this like capsicum on freebsd, [this video] , or jails in the FS, or both? Clearly I need to wake up.
Cites 2trill2spill · 2017-11 · on “Application Container Security Guide [pdf]”
> Sounds like a good use case for SELinux kinda, although you could implement sandboxing with SELinux it's going to take much more effort. SELinux is a Mandatory Access Control Framework and Capsicum is a hybrid Unix capabilities system. While there is overlap in what you can do with them they really our different sets of tools. Mandatory access controls are for system administrators to lock down and control access on a machine. Capsicum is for application authors to sandbox their application. Ideally they should be used together. Back to my point that while MAC(SELinux) can be used for sandboxing but will take more effort then using something like capsicum or pledge. With MAC you have to th