1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
|
Sandboxing r2
=============
radare2 supports sandboxing natively by wrapping all attempts
to access the filesystem, network or run programs.
But for some platforms, the kernel provides a native sandboxing
experience. ATM only OSX and OpenBSD are supported by r2, feel
free to extend the support to Linux and Windows.
OSX
---
OSX Seatbelt implements a system-level sandbox for applications,
the rules are described in a lispy .sb file:
$ sandbox-exec -f radare2.sb r2 -S /bin/ls
**NOTE**: r2 -S is an alias for -e cfg.sandbox=true
OpenBSD (from 5.9)
------------------
OpenBSD comes with support for sandboxing using the pledge(2) syscall.
Only the following are allowed:
- stdio and tty manipulation
- filesystem reading
- mmap(2) `PROT_EXEC` manipulation
OpenBSD (until 5.9)
-------------------
OpenBSD comes with support for sandboxing using the systrace utility.
$ man systrace
Generate default profile
$ systrace -A r2 /bin/ls
Run with the generated profile
$ systrace -a r2 -S /bin/ls
FreeBSD (from 10.0)
-------------------
FreeBSD comes with the Capsicum framework support,
using cap_enter(2).
Operations limited on what basic capability mode support.
Other
-----
Only r2's sandbox is supported.
- disables file system access
- disables network connectivity
- disables forks (no shell escapes or debugger)
- activated before showing the prompt
$ r2 -S /bin/ls
|
