The Apple Sandbox

More documents

Recommendations

Info

Giant sandworms!What’s under the sand hood?Before using it, how does itwork?Wednesday, January 19, 2011
XNU <strong>Sandbox</strong>Previously, codenamed “Seatbelt”For XNU systems, implemented as a TrustedBSD policymoduleRuntime configurable, per-process access control policyUsed to contain AppStore application on iOSWednesday, January 19, 2011
Page 3 and 4: I’m DionI work for ISE as a rever
Page 5 and 6: We should *totally* dosomething abo
Page 7 and 8: Got a bug, now what?OS exploit miti
Page 9 and 10: A simileExploitation is like a chas
Page 11 and 12: OS SupportFine-grained control via
Page 13 and 14: Not this talkSome sandbox escape. I
Page 15: Wednesday, January 19, 2011Giant sa
Page 19 and 20: user_processRegularSyscallssandboxd
Page 21 and 22: sandbox-execNAMEsandbox-exec -- exe
Page 23 and 24: Example: restrictingnetwork usagefl
Page 25 and 26: sandbox_init (cont.)AVAILABLE PROFI
Page 27 and 28: Too lazy for IDAfluffy:tmp dion$ ca
Page 29 and 30: Existing profilesfluffy:tmp dion$ l
Page 31 and 32: Trying our hand at itfluffy:tmp dio
Page 33 and 34: UserspaceIn an attempt to answer ou
Page 35 and 36: Wednesday, January 19, 2011sandbox_
Page 37 and 38: sandbox_init...else if (flags == SA
Page 39 and 40: Userspace: compilecompile is a nice
Page 41 and 42: Userspace: compileAnother scheme_lo
Page 43 and 44: Userspace: SBPL;;;;;; Sandbox Profi
Page 45 and 46: *rules*#( ((#t deny))((#f . 0))((#f
Page 47 and 48: Kernel EntryWe left userspace throu
Page 49 and 50: TrustedBSDTrustedBSD provides hooks
Page 51 and 52: sample.sbfluffy:sb dion$ cat sample
Page 65 and 66: AppleMatch.kextOne of the most popu
Page 67 and 68:
Utilitieslibsandcall: wrapping the
Page 69:
Wednesday, January 19, 2011Question
show all

The Apple Sandbox

Create successful ePaper yourself

Delete template?

Save as template?