libuv
Sandbox mode to run untrusted code?
I am very interested in sandboxing NodeJS at the libuv level to prevent untrusted code from doing any harm to the OS. Does this seem feasible? Am I the first person to try this at the libuv level?
What are you hoping to sandbox off? Not everything that Node.js does goes through libuv, e.g., process.setuid().
I want to run nodejs as a memory and cpu only application, and then allow communication to another process on the same localhost. Nothing else. No spawning processes, no FS, no other networking, no console (possible?), ideally no creating other threads, etc. I know some of this is possible in linux, but i'd love to see it in NodeJS as well.
While you could replace libuv with a shim that delegates to another process, that's not an approach I'd recommend. Without OS-assisted process-level isolation, every bug in Node.js or the shim is a potential sandbox-escaping exploit.
If you're looking for a battle-tested, cross-platform sandboxing solution:
https://chromium.googlesource.com/chromium/src.git/+/master/sandbox (design doc)
If anyone wanted to pursue this, here are some relevant research papers on the topic.
- De Groef et al. 2014 (I've probably broken a copyright law just now).
- Vasilakis et al. 2018
