SANDBOXING AND ISOLATION FOR SAFETY

SAFE DEFAULTS A safe sandbox starts closed and opens only what is needed. Give it no network access unless a specific destination is required. Give it a temporary folder that is erased when the run ends. Run it as a user with no special powers. Limit its memory, processing time, and number of processes so that a runaway program cannot starve the host. Do not place secret keys inside it, and if a key is unavoidable, give a narrow key that can be revoked. Defaults matter because people forget to tighten settings later. TESTING THE SANDBOX A wall you have never tested may not be a wall at all. Write a few harmless tests that try to do forbidden things from inside the sandbox, such as reaching a blocked website, reading a file outside the allowed folder, or using too much memory. Each test should fail safely, and the failure should be logged. Run these tests whenever the sandbox settings change, and add a test each time you learn of a new way out. This habit turns a hopeful belief that the sandbox is secure into evidence that it is.