Skip to content
Sandboxed API automatically generates sandboxes for C/C++ libraries
Branch: master
Clone or download
Sandboxed API Team Copybara-Service
Sandboxed API Team and Copybara-Service Internal change
PiperOrigin-RevId: 245377524
Change-Id: If41601b2d68c6ff0f7d3f37811aac62c32441d1f
Latest commit f3c9c6e Apr 26, 2019
Type Name Latest commit message Commit time
Failed to load latest commit information.
.clang-format Sandboxed API OSS release. Mar 18, 2019
.gitignore Add basic .gitignore file Mar 26, 2019 Sandboxed API OSS release. Mar 18, 2019
LICENSE Sandboxed API OSS release. Mar 18, 2019 Merge pull request #12 from PoignardAzur:patch-1 Mar 25, 2019
WORKSPACE Disable "mini" debug format support in libunwind to avoid additional … Mar 20, 2019

Sandboxed API

Copyright 2019 Google LLC


What is Sandboxed API?

The Sandboxed API project (SAPI) aims to make sandboxing of C/C++ libraries less burdensome: after initial setup of security policies and generation of library interfaces, an almost-identical stub API is generated (using a template-based programming variable hierarchy system), transparently forwarding calls using a custom RPC layer to the real library running inside a sandboxed environment.

Additionally, each SAPI library utilizes a tightly defined security policy, in contrast to the typical sandboxed project, where security policies must cover the total syscall/resource footprint of all utilized libraries.

Intended audience

SAPI is designed to help you sandbox only a part of binary. That is, a library or some other code with an unknown security posture.

See Sandboxing Code to make sure this is the type of sandboxing you are looking for.

How does it work?

Navigate to our How it works page.


Sandboxes available for use in Google required additional implementation work with each new instance of project which was intended to be sandboxed, even if it reused the same software library. Sandbox security policies and other restrictions applied to the sandboxed process had to be reimplemented each time, and data exchange mechanisms between trusted and untrusted parts of the code had to be designed from the scratch.

While designing the Sandboxed API project, our goal was to make this process easy and straightforward. Our working motto is: Sandbox once, use anywhere.

Is it proven technology?

The project has been designed, developed and is maintained by members of the Google Sandbox Team. It also uses our field-tested Sandbox 2.

Currently, many internal projects are already using SAPI to isolate their production workloads. You can read more about them in the Examples section.

We've also prepared some more example SAPI implementations for your reference.

Quick Start

Install the required dependencies, this assumes you are running Debian 10 "Buster":

echo "deb stable jdk1.8" | \
  sudo tee /etc/apt/sources.list.d/bazel.list
wget -qO - | sudo apt-key add -
sudo apt-get update
sudo apt-get install -qy python-typing python-clang-7 libclang-7-dev
sudo apt-get install -qy build-essential linux-libc-dev bazel

Clone and run the build:

git clone && cd sandboxed-api
bazel build ...

Try out one of the examples:

bazel run //sandboxed_api/examples/stringop:main_stringop

There are also a more detailed instructions that should help you getting started with SAPI.

Getting Involved

If you want to contribute, please read and send us pull requests. You can also report bugs or file feature requests.

If you'd like to talk to the developers or get notified about major product updates, you may want to subscribe to our mailing list or sign up with this link.

You can’t perform that action at this time.