Skip to content

security: emit OS sandbox profile (sandbox-exec / seccomp+landlock) alongside compiled binary #506

Description

@proggeramlug

The compiler knows which stdlib APIs the program could possibly reach (every js_* symbol referenced in the link). Derive the corresponding syscall set and emit a kernel-enforced sandbox profile next to the binary. A program that never imports child_process gets a profile denying fork/execve; one that imports fs only for reads gets a profile denying write syscalls; etc.

This is the only Tier-3 runtime mitigation worth shipping under the zero-perf constraint: the kernel enforces the profile on syscall entry, which is overhead the kernel pays anyway. Perry emits no extra checks in the binary itself.

Mechanism

HIR-driven derivation of reachable syscall set per binary, computed at compile time. Output:

  • macOS: <binary>.sandbox profile loaded via sandbox_init at process start (or sandbox-exec wrapper)
  • Linux: seccomp BPF filter installed at main entry (with landlock for FS scoping)

perry compile --emit-sandbox opt-in initially; on-by-default under --lockdown.

Zero per-call overhead in Perry's emitted code — the kernel does the syscall-entry check, which it already does for every syscall regardless of sandbox state.

Acceptance

  • Documented reachable-API → syscall-set mapping (which js_* symbols imply which syscalls)
  • macOS sandbox-exec profile generation from reachable stdlib set
  • Linux seccomp filter installed at process start (with landlock for FS path scoping)
  • Per-binary, computed entirely at compile time
  • perry compile --emit-sandbox flag (also perry.emitSandbox: true in host package.json)
  • Defaults on under --lockdown
  • Documented escape hatch for binaries that need to spawn unsandboxed children

Part of the supply-chain hardening series. Kernel-enforced — zero per-call overhead in emitted code. Host-app-controlled.

Metadata

Metadata

Assignees

No one assigned

    Labels

    enhancementNew capability or improvement

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions