Re: Arbitrary Sandbox

[Maciej Sobczak <see.my.homepage@gmail.com>]

On 10 Lut, 05:41, Rob Shea <zzyca...@gmail.com> wrote:

> >    Could you be more specific?  That sounds like a computer running
> > Windows, alone in a dedicated room, with no connections to the outside.
>
> Well, virtually speaking, that is exactly what I want... literally
> speaking it's a Windows system, networked, with removable disks, that
> needs to run untrusted code processing untrusted data.

> In other words, a very simple and restrictive, operating system level
> virtualization tool for Windows, that can be initiated by unprivileged
> users.

Then I don't understand why you got stuck at the level of language
choices. Neither .NET nor Ada will provide you this level of isolation
- both can initiate malicious network connections and both can read
and write files, for example.

I think that you should take a look at virtualization solutions like
VMWare. This allows to create an operating system within an operating
system, which is great for experimentation as well as for creating
security sandboxes. In essence, such a sandbox is like a separate
machine, but does not require separate hardware.
What is most important, you can really run *arbitrary applications* on
such a sandboxed system (just as you have described in your initial
post), no matter what language they are written in. Note that if you
choose .NET as your "virtualization solution", then you will *not* be
able to run any application that is not .NET-based. Similarly, if you
pick Python, you will only be able to run Python applications on it.
Same for Java [*].
That does not count as "I can run arbitrary applications on it" for
me.

[*] Yes, I know that there are many .NET-based languages, and there
are many languages based on the JVM. Still, that does not count as "I
can run arbitrary applications on it".

The advantage of real virtual machines (of the VMWare or Parallels,
etc. kind) is that you can do with them things that you would never
find a courage to do with your physical machine. This is really a
great tool for creating experimental, testing or security sandboxes
and I'd recommend that you take a look at them.

--
Maciej Sobczak * http://www.msobczak.com * http://www.inspirel.com