| ||||||||||||||||||||||||||||||||||||||||||||||||||||
4th USENIX Windows Systems Symposium Paper 2000
[Technical Index]
Next: Introduction
User-level Resource-constrained SandboxingFangzhe Chang, Ayal Itzkovitz, and Vijay Karamcheti
Abstract:
The popularity of mobile
and networked applications has resulted in an increased
demand for execution
"sandboxes"--environments that impose irrevocable restrictions on
resource usage. Existing approaches rely on kernel modification for enforcing
quantitative restrictions (e.g., limiting CPU utilization of an application to
25%). However, the
general applicability of such approaches is constrained by the difficulty of modifying shrink-wrapped
operating systems such as Windows NT.
This paper presents a user-level sandboxing approach for
enforcing quantitative restrictions on resource
usage of applications. Our approach actively
monitors an application's interactions with the underlying system,
proactively controlling them to enforce the desired behavior.
Our approach leverages a core set of user-level mechanisms that are
available in most modern operating systems: fine-grained timers,
monitoring infrastructure, debugger
processes, priority-based scheduling, and page-based memory
protection. We describe implementation of a sandbox on Windows NT
that imposes quantitative restrictions on CPU, memory, and network usage.
Our results show
that application usage of system resources can be restricted to within 3% of
desired limits with minimal run-time overhead.
Next: Introduction Fangzhe Chang, Ayal Itzkovitz, and Vijay Karamcheti 2000-05-15 |
|
This paper was originally published in the
Proceedings of the 4th USENIX Windows Systems Symposium,
August 3-4, 2000, Seattle, Washington, USA
Last changed: 29 Jan. 2002 ml |
|
