Is it possible to sandbox the entire system?

DISCLAIMER
This is partly just thinking out loud.
There may be some completely obvious solution for achieving this that I have not come across.
My ideas may be flawed.
I saw the other thread about sandboxing but that had a different focus and went in a different direction than this hopefully will.
First, by sandboxing I mean the following:
* let an application see the actual system, but only selectively, e.g. make /usr visible but /home inaccessible
* intercept all writes to the system
* let an application see all intercepted writes as though they have actually occurred
* intercept all network communication and allow the user to approve or deny it, e.g. enable a source download from one site but prevent the application from calling home to another
* the application cannot escape the sandbox
* the application should not be able to detect the sandbox
Is this possible?
First I thought about using FUSE to mask the entire filesystem but this would affect all applications and probably wouldn't work on a running sysem.
Then I thought about using virtualization. Maybe it would be possible to create a fake base image of the live host system and then add an overlay to that to create a sandboxed virtual clone of the host system. The network connection could probably by the host in that case.
I don't know if it would be at all possible though to create a fake base image of the live host system. I also don't know if it would need to be static or if the image could remain dynamic. In the latter case. it would probably be possible to create the image with FUSE. Using FUSE it might even be possible to forgo the overlay image as FUSE itself could intercept the writes. There are obvious complexities in that though, such as how to present changes to a file by the host to the guest if the guest has modified it previously. I also have no idea if the guest system could use a clone of the hosts file system.
Why I would want to do this:
* "Safely" test-run anything while protecting your system (hide your sensitive data, protect all of your files, control network access)**.
* Simplified package building: build the application as it's meant to be built in the sandbox, compare the sandbox to the host and then use the differences to build the package***.
* It would be cool.
** Before anyone interjects with the "only run trusted apps" mantra, this would also apply to trusted apps which might contain bugs. Let's face it, most people do not plough through source code of trusted apps before building/installing/running them.
*** This was prompted by my ongoing installation of SAGE which is built in the post-install function instead of the PKGBUILD itself due to the complexities of the build process. The general idea is to create a way in which all application that can be built can be packaged uniformly.

Are you sure that you can change the permissions of symlinks themselves? I think I've tried to make files read-only via symlinks on a local server but ended up using bindfs because it wasn't possible. Even if you can, symlinking everything that might be necessary for a given environment would not be ideal, plus I don't think symlinks can be used across different filesystems.
If a real-life human can figure out if it's he/she is in a chroot and break out of it, then he/she can write a script to do the same. I want a sandbox that could run malicious code with no effect on the system (if that's possible). Also, I think if the chroot idea were truly feasible, makepkg would have been using it for years already to simply install packages in the chroot as you normally would and then package them. There would also be several sandbox applications that could run applications safely. So far I have yet to find any.
I admit that I haven't looked into using a chroot in detail though and of course I may have missed some application which creates such a setup. Right now I think using per-application namespaces with fuse seems the most promising but I won't know until I've finished implementing a test application. If it turns out that it's a dead end I'll take harder look at chroot but it really doesn't seem to be able to do what I want.

Similar Messages

Is it possible to clear the entire Bookmarks list at one time in Safari for Windows?

Hello. Is it possible to clear the entire Bookmarks list at one time in Safari for Windows? I would like to continue to use the Safari browser even though I have Windows 7 as the operating system on my notebook. When I try to delete bookmark entries one at a time, after deleting several, errors start popping up in the browser. Can I reinstall Safari without the Bookmarks I've built up? Please help a humbled Safari user.

Are you sure that you can change the permissions of symlinks themselves? I think I've tried to make files read-only via symlinks on a local server but ended up using bindfs because it wasn't possible. Even if you can, symlinking everything that might be necessary for a given environment would not be ideal, plus I don't think symlinks can be used across different filesystems.
If a real-life human can figure out if it's he/she is in a chroot and break out of it, then he/she can write a script to do the same. I want a sandbox that could run malicious code with no effect on the system (if that's possible). Also, I think if the chroot idea were truly feasible, makepkg would have been using it for years already to simply install packages in the chroot as you normally would and then package them. There would also be several sandbox applications that could run applications safely. So far I have yet to find any.
I admit that I haven't looked into using a chroot in detail though and of course I may have missed some application which creates such a setup. Right now I think using per-application namespaces with fuse seems the most promising but I won't know until I've finished implementing a test application. If it turns out that it's a dead end I'll take harder look at chroot but it really doesn't seem to be able to do what I want.

I am using a mac mini 2011 an 3gs i phone 2010 macbook white 2008 and a new 2013 apple tv box. When i check info on the cloud I get 'upgrade your operating system to the latest. My question is is it possible to use the icloud system without an upgrade

I am using a mac mini 2011 an 3gs i phone 2010 macbook white 2008 and a new 2013 apple tv box. When i check info on the cloud I get 'upgrade your operating system to the latest. My question is is it possible to use the icloud system without an upgrade

iCloud requires OS X 10.7.2.

Is it possible to display the entire list in Background ?

Hi all,
I have alv report(Oops) , it is grid display and having more than 300 columns , when i execute that report in background i am getting only 132 columns and 65 lines per page, Is it possible to display the entire list , If it is possible then how we can do that? if it is not what is the reason? .
Thanks in Advance.

Hi,
If use Grid in BG u will get o/p In ALV List Itself, second thing is u will get Croped o/p bcos of Print Format 65255 , in this case u have to create/change a new Print Format only for BG jobs like 651000.
for more info ask ur basis person to create a new print formats in such cases.
Regards,
shiva.

I have an Apple Macbook and will be backing up the entire system to an external hard drive utilizing the Time Machine application. when I am doing this, will the data on the external drive that I am using be erased?

I have an Apple Macbook and will be backing up the entire system in order to upgrade to a newer OS. I will be using an external hard drive to do this and there is already data on it. To complete the backup, i will be using the Time Machine application. Does this application wipe out all of the existing data on the external hard drive, or will it create a new "folder" for the backup?
thank you

No, but as steve359 states you should use a dedicated hard drive for backups. It you need a temporary backup then you can use the drive provided it has sufficient space for all your data on the hard drive.
When Time Machine finds that the drive has data on it already it may decide to erase the drive before continuing, which is another reason to use a dedicated drive.

How to delay the audio to lip sync? (of the entire system)

I`m using a LED 32" LG screen via hdmi, but the audio is outputing directly via usb to my Mbox Mini, and the image have a small delay (5 frames) but the audio not, so the result is out of sync videos.
Of course there`s tons of apps that can solve the problem by compensating, like VLC and MPlayer X, but the problem is that i`m a video editor and use FCP and Motion all the time. For playbacking with these apps (after making the 5 frames compensation) turns into a perfect results, but during video editing it`s a pain to lip sync.
Of course as i know that the delay is 5 frames, when i output i could delay the entire audio, but it would be a pain making this everytime and for internet streaming the videos would still off sync.
There`s anyway i can delay the audio of the entire system?
PS: I`m using Lion 10.7,

> I wonder if there is any way to delay the opening of a
MIAW. In particular i
> have the following
If you want other activity to take place, you could use a
timeout object:
dialogue = window().new("D_XML_Test (Greek2)")
dialogue.filename = "path to file"
t = timeout().new("mOpenWindow", 60000, #mOpenWindow,
dialogue)
-- #movie script:
on mOpenWindow aWindow, aTimeout
if ilk(aTimeout, #timeout) then aTimeout.forget()
if ilk(aWindow, #window) then aWindow.open()
end
If you don't mind locking out activity, you could use the
delay()
function, but I wouldn't recommend that approach

Safari pinwheels and freezes the entire system.

Safari pinwheels and freezes the entire system.
I've read numerous threads with this Safari pinwheeling theme, but none of the posted solutions I've found work for me.
The problem:
Safari will almost always on opening, and frequently when filling in forms on websites, start pinwheeling. The whole system then slows down, and then eventually freezes. Even the dock bar freezes. When this happens, I can't even bring up the Force Quit bar. The freezing will often last several minutes, then all of a sudden, all my various previously ignored mouse and key clicks cycle through. When Force Quit finally starts, then everything freezes again. Eventually, Force Quit will show Safari as not responding, and once in a while the system then will start responding, but usually I have to kill Safari.
The problem subsided a little bit on the opening the application problem when I switched my start page from Apple.com to Google.com, thinking that maybe it was just too much graphics crap coming in on the Apple site.
The problem happens on both my Airport and cell modem network connections.
I may have seen this behavior once with Firefox, but haven't been able to reproduce it.
Generally I only have a few things running: Excel, Messenger, Safari.
Things I've tried to fix this:
Reset Safari
Clear Safari Cache
Delete Safari folder in the system cache folder
Went into the Energy Saver in Preferences and unchecked, "put disk to sleep when not in use" for both the battery and power adpater settings
Limit number of tabs open
I'd try restarting Safari occasionally, but the problem usually happens on opening.
I've emptied the trash, and made sure there is ample open disk space (10gb right now).
Resolved duplicate fonts.
I have no third party apps to affect Safari or networking.
I've reset the machine by unplugging it and holding the power button.
My computer is a MacBookPro 15" with all the latest software and firmware updates and 2gb RAM. This has become so frustrating, it's been very tempting to just throw the laptop at the wall and go back to my Windows laptop...

I'd say the bad blocks were behind the problems you were seeing. Their existence points to either a defective HD, or directory corruption. The latter usually can be repaired by using a Utility such as Disk Warrior, or as you did, reformatting the drive.
Best approach to minimizing directory problems is to do routine maintenance twice a month. Have a look at this MacWorld article for suggestions.
For routine maintenance I use OnyX. There is no charge for the software, but I believe the developer asks for a donation.
It's very easy to use. I run it twice a month. Once it is installed, you would double click on the OnyX icon in your application folder (or drag an icon to your dock for quick access) to open the application. After entering your administrator password, you would select "automation". The panel looks like this:
Select the same items I have checked. The program takes about 5 to 10 minutes to run. Leave your computer alone, that is, don't use it for anything else until OnyX is finished. Once complete, restart the computer and you're good to go.
Lastly, the most effective maintenance is having a full backup of your system on an external hard drive. All machines fail eventually, despite the best maintenance. If you had a hard drive failure without any backup, then you would lose all your information, including documents, images, songs, etc. Not a pretty picture.
For your system, you would purchase either a USB or Firewire Drive for your new Intel Machine. The key here is creating a "clone" backup on the drive, which you back up regularly, or at least once a week. For the backup process I use SuperDuper. Very easy to use. The initial backup takes about 1 to 2 hours. Subsequent backups take 5 to 10 minutes. Total $$$ investment can be anywhere between $100 - $250 depending on the size of your Hard Drive.
Post back if you need any other information relative to your questions here.

GuiXT valid throughout the entire system

<b>GuiXT</b>
I need to customize my VA01 transaction using GuiXT. But I dont want it
to be user-specific on user's PC but throughout the entire system.
The document that i have seen says that put the GuiXT script file on application server
for the same.
But I have seen that for every user there is Script1 . . Script4
directory setting and this is where the VA01 will look before loading.
So even if I keep the script file on the server, if these Script directory
is not set to the required path, it will not reflect any changes that i have
made.
SO will i have to go on each user machine and give the path
or is there a way out.

Hi Flora,
Have you looked transaction code <b>SHD0</b> to create transaction variant to customize SAP screen?
This transaction variant can be applied for user group or individual user.
For more information, please check this link.
http://help.sap.com/saphelp_nw04/helpdata/en/7d/f639fb015111d396480000e82de14a/content.htm
Hope this will help.
Regards,
Ferry Lianto

FCPX crashes the entire system when applying Ken Burns

When applying Ken Burns to an image, when repositioning the start and/or end frame the entire system locks up, not just FCPX. The cursor can still be moved, but other than that the entire system is unresponsive and the only solution is turning off my iMac and rebooting. That is how the problem started, a few days later during the same process the entire screen turns black and rebooting is once again the only way out.
Is anyone else familiar with this problem?

There's a little icon that appears in the Project on top of each picture that has Ken Burns applied, click on that icon (it's a cropping square icon). that will bring up the Inspector and show you the red/green boxes that indicate the area where the zoom starts and ends for Ken Burns. If you drag the edges of both the red/green boxes individually to fit the entire picture, I think you will get the effect of not cropping. But it won't really be Ken Burns either because it won't zoom/pan across the image as it plays back.

Is it possible to buffer the entire JTable for JScrollPane scrolling?

With the following code, when you scroll up and down you get lots of "called" output.
I will know when my jtable is updated, so is there
some way I can get the scrollpane to buffer the entire jtable component
so that subsequent scrolling just does drawing of the appropriate part
of the jtable from a buffered image? Note that the cells still need to
be editable (I've got cell editors). Possible? Here's the code :
public class TableBufTest {
    public static void main(String[] args) {
        String[][] data = new String[30][2];
        for (int i=0; i<2; i++) {
            for (int j=0; j<30; j++) {
                data[j] = Integer.toString(j*10 + i);
String[] columnNames = new String[] {"1", "2"};
final JLabel jLabel = new JLabel();
JTable table = new JTable(data, columnNames);
table.getColumnModel().getColumn(0).setCellRenderer(new TableCellRenderer() {
public Component getTableCellRendererComponent(JTable table, Object value,
boolean isSelected, boolean hasFocus,
int row, int column) {
System.out.println("called");
jLabel.setText((String) value);
return jLabel;
JScrollPane scrollPane = new JScrollPane(table);
JFrame jFrame = new JFrame();
jFrame.getContentPane().add(scrollPane);
jFrame.setDefaultCloseOperation(JFrame.EXIT_ON_CLOSE);
jFrame.setSize(200,200);
jFrame.setLocation(300,300);
jFrame.show();
Thanks!

Thanks.
I ended up doing a couple of things - first of all using JLabels instead of JTextFields
and then creating my own FastJLabel using the DefaultTableCellRenderer as a basis.
(I couldn't use it because I have to return different components for different rows.)

It is possible to transpor the logical system definition and the RFC

Hello,
To define the back-end logical system we need to link the RFC destination SM59. If it is not possible to TRANSPORT the RFC destination from the development system to the quality one, I need to create the quality back-end logical system without transport.
In SRM there is a lot customizing in which we need to assing the back-end logical system. If I can not transport the back-end logical system definition from development to quality I must "re-create" a lot of customizing ditectly in quality (and later in production!)
This is the normal way to work in SRM? Do I have to create the RFC destination, the back-end logical system, etc. in each eviroment (development / quality / training / acceptance / production) or there is a way to transport this?
Cheers,
Marta

Hi Marta,
transporting in SRM is different from the other SAP areas. There are several
objects, which are normally customizing, but in SRM not part of the transportable
objects. You have to do quite a lot of settings manually in QA as well in PROD.
Start the discussion early to get the needed authorizations for doing the settings.
The following doc gives an overview and explains:
https://websmp201.sap-ag.de/~form/sapnet?_FRAME=CONTAINER&_OBJECT=011000358700000310782007E
Cheers,
Claudia

Is it possible to change the Logical System name in ID

Hi,
I am doing a file to Idoc scenario. My requirement is to overwrite the logical system name, which is set in SLD for sender (system). Is it possible to overwrite it in ID or in mapping somewhere.
Thanks,
Dehra

Hi Dehra,
Go through the below help file of SLD. It will give you information regarding logical name as well:
<a href="http://xiserver:50100/sld/doc/sld.pdf">http://xiserver:50100/sld/doc/sld.pdf</a>
Regards,
Subhasha

Hi I bought a macbook in 2007/2008 and am wondering if it is possible to update the operating system? Here are my system details: Hardware Overview:    Model Name:     MacBook   Model Identifier:     MacBook4,1   Processor Name:     Intel Core 2 Duo   Pro

Hi, I bought a Macbook in 2007/2008 and am wondering if it is possible to update my system so I can get the new version of iTunes?
Here are my current system details: Mac OsX Version 10.5.8
Hardware Overview:
Model Name:    MacBook
Model Identifier:    MacBook4,1
Processor Name:    Intel Core 2 Duo
Processor Speed:    2.4 GHz
Number Of Processors:    1
Total Number Of Cores:    2
L2 Cache:    3 MB
Memory:    2 GB
Bus Speed:    800 MHz
Boot ROM Version:    MB41.00C1.B00
SMC Version (system):    1.31f1

The model 4,1 can run a maximum of 10.7 Lion. The 10.6 Snow Leopard DVD is in the Apple online store. You can get it for $19.99. After you’ve installed that then download the 10.6.8 combo updater to finish it off. http://support.apple.com/kb/DL1399 You will need to be running 10.6.8 to access the App Store to order Lion. http://store.apple.com/us/product/MC573/mac-os-x-106-snow-leopard
System Requirements for 10.6:
Mac computer with an Intel processor
1GB of memory
5GB of available disk space
DVD drive for installation
Some features require a compatible internet service provider: fees may apply.
You can upgrade from 10.5 to 10.6 with no problems as long as you have at least 1gb of RAM. Any program that runs under 10.5 should run under10.6. See this list for third party programs compatibility with 10.6: http://snowleopard.wikidot.com/ You might have to upgrade some drivers for printers, etc.... And you will have to install Rosetta if you have any Power PC applications
http://www.macobserver.com/tmo/article/snow_leopard_installing_rosetta/
Once you are at 10.6.8 Lion is still available from Apple. You will have to call Apple Customer Care 1-800-692-7753 or 1-800-676-2775. to purchase it. Then within 3 days you will get an email with a code which you can use to download Lion from the App Store. Or go to http://store.apple.com/us/product/D6106Z/A/os-x-lion and purchase it there. The price is $19.99.
Lion will require at least 2gb of RAM but really needs 4gb to run smoothly.
As for third party programs see this list for compatibility with 10.7 http://roaringapps.com/apps:table
Also Lion doesn't run any Power PC programs. To see if you have any Power PC programs go to the Apple in the upper left corner and select About This Mac, then click on More Info. When System Profiler comes up select Applications under Software. Then look under Kind to see if any of your applications are listed as Power PC. Universal and Intel will run under Lion.
Before Mac switched to Intel processors in 2006 they used Power PC processors from 1994 to 2005. Power PC 601 through 604, G3, G4 and G5. Applications written for the Power PC processors need the application called Rosetta to run on Intel processors. This was part of the Operating System in 10.4 and 10.5 but was an optional install in 10.6. With 10.7 Lion Apple dropped all support for Power PC applications.

Mouse tooltip is locking the entire system

Hello friends at www.oracle.com ,
after defining some tooltips to Forms fields like text items, display items, push buttons, etc., I've seen that the following sequence of actions may cause a system lock. (Assume there's a main Forms program, and a Forms sub-program has been called through main menu.)
1. Put the mouse pointer over a field that has tooltip text.
2. Close the Forms sub-program by pressing ALT-F4 (Windows shortcut to close any program); it will take you back to the Forms main program. (Tooltip text will still stay stopped at mouse position)
3. Move to another Windows program, like Explorer for example, and try to return to the main program. This main program is now locked, shows the 'Working...' message at hint line, and stays locked.
Only CTRL+ALT+DEL will stop it, and the Forms main program never sends any answer.
Could you please tell me why does a simple tooltip may lock an entire system?
Hope I was clear - if not, please ask me.
Thanks, and best regards,
Franklin Gongalves Jr.

Quit the App Store app and reset your iPad.
Double click the Home button to show the screen with running and recently used apps. Each app icon will have a sample page above it. Flick up on the page (not the app icon) and the page will fly away and the app icon will disappear. This quits that app. Then reset your device. Press and hold the Home and Sleep buttons simultaneously until the Apple logo appears. Let go of the buttons and let the device restart. See if that fixes your problem.

[Solved by moving to Ubuntu] VirtualBox freezes the entire system

Hello everyone,
I have some major issues with VirtualBox, I have recently installed it for the first time, but it just randomly freezes my entire system. There shouldn't be any load on the processor for this to happen. I don't really know what the cause is. I tried both Windows XP and Windows 7 as guest systems with the same sad outcome. The host and guest freeze and I have to do a hard restart. There always is some noise that comes from the sound card and, in the case of VMWare, from the case speaker.
I tried disabling AMD-V - using a Phenom II x4 955 - but it didn't work. I also tried adding nohz=off to the grub line but it also didn't work. I have recompiled the kernel modules after the last kernel update - 2.6.32. I can't really say whether it's only related to the last kernel update or not as I only started using it after the update.
It seems that I have similar issues with VMWare player.
Here's my system information:
Arch64
Kernel 2.6.32
Phenom II x4 955
4 GB of ram
Virtualbox 3.1.2-2 from the AUR
This only issue occurs with VirtualBox and VMWare, I did test the memory and it's okay. I also have plenty of fans - 2x120mm + 2x80mm - and my system temperature (using k10temp) never goes above 48 c under load. So, it isn't an issue with overheating.
Does anyone have any similar issues? Do you have any suggestions for this?
Thanks!
Last edited by DavidR (2010-01-21 23:54:22)

Should I ask to have this thread moved to the 'Pacman & Package Upgrade Issues'? Will anyone be able to help there? I am seriously starting to consider downgrading the kernel once again and seeing whether it will work.
Does anyone have a machine with another 64-bit distro with this kernel version? If so, can the problem be replicated there? I don't know whether this is really related to Arch or the kernel. Should I file a bug report somewhere? and if so, where can I do it?
http://www.archlinux.org/news/477/
May it be related to the xen support that has been added to Arch64?
Last edited by DavidR (2010-01-14 08:18:30)

Is it possible to sandbox the entire system?

Similar Messages

Maybe you are looking for