MBOX()

Mbox is a lightweight sandboxing mechanism that any user can use without special privileges in commodity operating systems.

The Sandbox
Mbox introduces a novel sandbox usage model; when executing a program in the sandbox, Mbox prevents programs from modifying the host filesystem while giving them the impression that they are in fact making those modifications. Mbox achieves this by providing a layered sandbox filesystem and by interposing on system calls with ptrace and seccomp/BPF. At the end of program execution, the user can examine changes in the sandbox filesystem, and selectively commit them back to the host filesystem.

Example
$ mbox -- wget google.com
...
Network Summary:
 > [11279] -> 173.194.43.51:80
 > [11279] Create socket(PF_INET,...)
 > [11279] -> a00::2607:f8b0:4006:803:0
 ...
Sandbox Root:
 > /tmp/sandbox-11275
 >  N:/tmp/index.html
[c]ommit, [i]gnore, [d]iff, [l]ist, [s]hell, [q]uit ?>

Usage

  Installing packages without root
 $ mbox -R -- apt-get install git
  (-R: emulate a fakeroot environment)

  Running unknown binary safely
 $ mbox -n -- wget google.com
  (-n: disable remote network accesses)

  Checkpointing filesystem
 $ mbox -i -- sh
  (-i: enable interactive commit-mode)

  Build/development environment
 $ mbox -r outdir -- make
  (-r dir: specify a sandbox filesystem)

  Profile-based sandbox
 $ mbox -p build.prof -- ./configure
  (-p prof: enable profile-based policy)

    ## build.prof
    [fs]
        allow: .
        hide: ~