Sandbox

Sandbox — code, process, document yoki applicationni cheklangan va nazorat qilingan muhitda ishga tushirib, uning asosiy tizim, fayllar, qurilmalar va networkga ta’sirini kamaytiradigan xavfsizlik mexanizmi. Sandbox ishonchsiz yoki qisman ishonchli code’ni to‘liq huquq bilan ishlatmaslik uchun qo‘llanadi.

Browser tab, mobile application, document preview, online code runner va malware analysis tizimlarida sandbox modeli uchraydi.

Cheklangan muhit

Sandbox ichidagi processga faqat zarur resource’lar beriladi.

Masalan:

• ma’lum directory;
• cheklangan memory;
• ayrim system call;
• network yo‘q;
• device yo‘q;
• vaqt limiti;
• non-root user.

Process cheklovdan tashqaridagi resource’ga murojaat qilsa operation rad etiladi.

Browser sandbox

Browser renderer processi web sahifa code’ini alohida past privilege muhitda bajarishi mumkin.

Sahifa exploit orqali renderer ichida code bajarsa ham host file va boshqa processlarga to‘g‘ridan-to‘g‘ri access cheklanadi.

To‘liq compromise uchun attackerga sandbox escape kerak bo‘lishi mumkin.

Mobile application sandbox

Mobil operatsion tizim har applicationga alohida identity va storage beradi.

Application boshqa app data’siga bevosita kira olmaydi.

Camera, location, contact va microphone kabi resource’lar permission orqali beriladi.

Root yoki platform vulnerability sandboxni buzishi mumkin.

Process isolation

Sandbox alohida process, user yoki namespace’dan foydalanishi mumkin.

OS boundary:

• address space;
• process table;
• file mount;
• network namespace;
• UID;
• capability

bo‘yicha ajratadi.

Process isolation container va browser architecture’da keng qo‘llanadi.

System call filtering

Process faqat ruxsat etilgan system calllarni ishlata oladi.

Keraksiz yoki xavfli syscall rad etiladi.

Bu kernel attack surface’ini kamaytiradi.

Policy application behavioriga mos bo‘lmasa qonuniy operation ham buzilishi mumkin.

Filesystem

Sandboxga:

• read-only system file;
• temporary writable directory;
• specific input file;
• output directory

berilishi mumkin.

Host root filesystem to‘liq mount qilinmaydi.

Path traversal va symbolic link orqali boundary bypass qilinmasligi kerak.

Network

Untrusted code ko‘pincha network accesssiz ishlatiladi.

Agar network zarur bo‘lsa:

• faqat ma’lum destination;
• proxy;
• DNS cheklovi;
• bandwidth;
• request limit;
• metadata blok

qo‘llanadi.

Aks holda code data exfiltration yoki ichki network scanning qilishi mumkin.

Resource limit

Sandbox DoS ta’sirini ham cheklaydi.

Limitlar:

• CPU time;
• wall-clock time;
• memory;
• process soni;
• file descriptor;
• disk;
• output hajmi;
• network.

Infinite loop yoki fork bomb boshqa tenantlarni ishdan chiqarmasligi kerak.

Document sandbox

PDF, office document, image yoki media parser alohida processda ishlashi mumkin.

Parser exploit qilinsa asosiy application secret va database credentiallariga access bo‘lmasligi kerak.

Natija safe formatga qayta yaratilishi mumkin.

Online code runner

User yozgan code serverda ishga tushirilganda:

• ephemeral environment;
• network disabled;
• resource quota;
• read-only base image;
• no secret;
• output limit;
• automatic cleanup

talab qilinadi.

Faqat container yaratish yetarli emas; kernel va runtime threat modeli hisobga olinadi.

Malware sandbox

Security jamoasi shubhali faylni izolyatsiyalangan muhitda ishga tushirib behaviorini kuzatadi.

Kuzatiladi:

• process;
• file;
• registry;
• network;
• persistence;
• memory;
• API call.

Malware virtual muhitni aniqlab zararli behaviorni yashirishi mumkin.

Sandbox escape

Sandbox escape — code cheklangan muhitdan chiqib, yuqoriroq privilege yoki host resource’ga access oladigan zaiflik.

Escape:

• kernel bug;
• broker process xatosi;
• noto‘g‘ri permission;
• unsafe IPC;
• host mount;
• runtime vulnerability

orqali yuz berishi mumkin.

Broker modeli

Sandboxed process ayrim privileged operationni bevosita bajarmaydi.

U trusted brokerga request yuboradi.

Broker requestni validation qilib, faqat ruxsat etilgan amalni bajaradi.

Broker interface’i juda keng bo‘lsa sandbox boundary zaiflashadi.

Sandbox va virtual machine

Virtual machine alohida guest OS va kuchliroq isolation berishi mumkin.

Process sandbox yengil va tezroq.

Tanlov:

• threat darajasi;
• performance;
• kernel sharing;
• startup vaqti;
• resource

ga bog‘liq.

Yuqori xavfli untrusted workload uchun microVM yoki alohida host ishlatilishi mumkin.

Sandbox va container

Container namespace va cgroup orqali isolation beradi, ammo host kernelni share qiladi.

Privileged container yoki runtime socket sandboxga zid.

Container security policy, syscall filter va minimal capability bilan kuchaytiriladi.

Ephemeral muhit

Har taskdan keyin sandbox butunlay yo‘q qilinadi.

Oldingi user fayli, processi yoki secretlari keyingi taskga qolmaydi.

Reusable worker ishlatilsa kuchli cleanup va reimaging kerak.

IPC

Sandboxed process trusted broker bilan IPC orqali aloqa qiladi. Message schema, size va operation allowlist bilan tekshiriladi. Parser xatosi yoki confused deputy muammosi sandbox escape’ga olib kelmasligi kerak. Privileged broker user bergan arbitrary path yoki commandni bajarib bermaydi.

Snapshot va reset

Analysis yoki code execution sandboxi har run oldidan toza snapshotdan boshlanadi. Run tugagach memory, disk, network state va temporary credential yo‘q qilinadi. Faqat output validationdan keyin tashqariga olinadi. Zararli symlink yoki archive sandboxdan export jarayonini chetlab o‘tmasligi kerak.

Nested virtualization

Yuqori xavfli workload container ichida microVM kabi qo‘shimcha boundary bilan ishlashi mumkin. Bu startup va resource xarajatini oshiradi, ammo shared kernel riskini kamaytiradi. Security darajasi workload trustiga mos tanlanadi.

Bog‘liq tushunchalar

Isolation, Sandbox escape, Container, Virtual machine, System call filtering, Least privilege, Browser security, Malware analysis, Resource limit, Ephemeral environment