A sandbox is only useful if you know its edges: the trust boundaries, what each layer guarantees, and what is out of scope.
Trust placed in userspace is kept as small as the policy allows.
Evaluates Landlock and seccomp. Sandlock shares it with the workload; if the kernel is compromised, so is every guarantee here.
Runs in the parent, outside the sandbox, deciding the syscalls the kernel hands it. Built-in handlers run first, so a custom one can extend confinement but never relax it.
Assumed hostile. NO_NEW_PRIVS, Landlock, and seccomp are installed and inherited descriptors closed before exec, so it never runs unconfined.
NO_NEW_PRIVS makes a setuid binary confer nothing.RLIMIT_NOFILE again. It is a budget.seccomp_unotify(2) documents the hazard: after a continue verdict, the kernel re-reads any argument passed by pointer, so a path string a supervisor inspected can be overwritten before the kernel acts. Filtering on path strings in userspace is unsound, however carefully written. Sandlock addresses it two ways.
Events carry the syscall, PID, network destination, and argv, never a path. Path decisions belong in Landlock rules, which the kernel resolves at access time. Runtime decisions use deny_path() and allow_path(), which add Landlock restrictions rather than filtering strings.
Before exposing argv for an execve, the supervisor freezes every task in its process index, including peers that could alias the memory. If the freeze cannot be established, for instance under a YAMA ptrace policy, the syscall is denied with EPERM. The invariant is never silently relaxed.
Sandlock starts from deny. A permissive default fails silently: you learn about the gap from an incident rather than an error.
| Surface | With no policy | To open it up |
|---|---|---|
| Filesystem | Nothing readable or writable, not even /usr. |
Name every path. |
| Network | No TCP connect; no UDP, ICMP, or raw socket creation. | --net-allow '*' explicitly; ICMP needs its own icmp:// rule. |
| Syscalls | The default blocklist, always. | Named groups only, such as System V IPC. A typo fails loudly. |
| Kernel protections | All enforced; Sandlock refuses to start if one is missing. | Per protection: allow_degraded or disable. |
A sandbox's protection posture is part of its checkpoint, so a restore keeps the protections it was built with. sandlock check reports the host's Landlock ABI.
A workload can use a secret without holding it. The supervisor loads it from an environment variable, file, or descriptor and attaches it in the proxy strictly after the ACL check, so a rejected request never carries it.
env: source is stripped from its environment; an fd: source never touches disk.--http-inject-ca writes only the public certificate into the bundles you name.There is no secret-manager client, deliberately. Vault, a cloud store, or a CSI driver materializes the value into a file: or fd: source, off ps and out of shell history.
The guarantees above, and the attacks out of scope, are stated formally in the paper.
“It also supports dynamic network decisions, HTTP-level access control, TOCTOU-safe inspection of execve arguments, and reversible filesystem effects. On our workstation, Sandlock adds roughly 5 ms of startup overhead and runs Redis at bare-metal throughput (within measurement noise).”
Found a way out of a Sandlock policy? We want to hear it first.
Email contact@multikernel.io with a reproducer where possible. Please do not open a public issue until we have responded.