The compiler knows which stdlib APIs the program could possibly reach (every js_* symbol referenced in the link). Derive the corresponding syscall set and emit a kernel-enforced sandbox profile next to the binary. A program that never imports child_process gets a profile denying fork/execve; one that imports fs only for reads gets a profile denying write syscalls; etc.
This is the only Tier-3 runtime mitigation worth shipping under the zero-perf constraint: the kernel enforces the profile on syscall entry, which is overhead the kernel pays anyway. Perry emits no extra checks in the binary itself.
Mechanism
HIR-driven derivation of reachable syscall set per binary, computed at compile time. Output:
- macOS:
<binary>.sandbox profile loaded via sandbox_init at process start (or sandbox-exec wrapper)
- Linux: seccomp BPF filter installed at
main entry (with landlock for FS scoping)
perry compile --emit-sandbox opt-in initially; on-by-default under --lockdown.
Zero per-call overhead in Perry's emitted code — the kernel does the syscall-entry check, which it already does for every syscall regardless of sandbox state.
Acceptance
Part of the supply-chain hardening series. Kernel-enforced — zero per-call overhead in emitted code. Host-app-controlled.
The compiler knows which stdlib APIs the program could possibly reach (every
js_*symbol referenced in the link). Derive the corresponding syscall set and emit a kernel-enforced sandbox profile next to the binary. A program that never importschild_processgets a profile denyingfork/execve; one that importsfsonly for reads gets a profile denying write syscalls; etc.This is the only Tier-3 runtime mitigation worth shipping under the zero-perf constraint: the kernel enforces the profile on syscall entry, which is overhead the kernel pays anyway. Perry emits no extra checks in the binary itself.
Mechanism
HIR-driven derivation of reachable syscall set per binary, computed at compile time. Output:
<binary>.sandboxprofile loaded viasandbox_initat process start (orsandbox-execwrapper)mainentry (with landlock for FS scoping)perry compile --emit-sandboxopt-in initially; on-by-default under--lockdown.Zero per-call overhead in Perry's emitted code — the kernel does the syscall-entry check, which it already does for every syscall regardless of sandbox state.
Acceptance
js_*symbols imply which syscalls)perry compile --emit-sandboxflag (alsoperry.emitSandbox: truein host package.json)--lockdownPart of the supply-chain hardening series. Kernel-enforced — zero per-call overhead in emitted code. Host-app-controlled.