security.html

---
layout: default
title: "Security Model and Threat Model"
description: "Sandlock's threat model: trust boundaries, what each enforcement layer guarantees, how TOCTOU is handled, default-deny posture, and the limits of the sandbox."
permalink: /security.html
author: "Cong Wang"
last_modified_at: 2026-08-28
---

<style>
.boundary-grid {
    display: grid;
    grid-template-columns: repeat(3, 1fr);
    gap: var(--space-5);
    margin-top: var(--space-10);
}

.boundary {
    padding: var(--space-6);
    background: white;
    border: 1px solid var(--gray-200);
    border-top: 2px solid var(--accent-500);
    border-radius: var(--radius-lg);
}

.boundary .tier {
    font-family: var(--font-mono);
    font-size: 10px;
    text-transform: uppercase;
    letter-spacing: 0.12em;
    color: var(--gray-400);
    display: block;
    margin-bottom: var(--space-2);
}

.boundary h3 {
    font-size: var(--text-base);
    font-weight: 700;
    color: var(--gray-900);
    margin-bottom: var(--space-3);
}

.boundary p {
    font-size: var(--text-base);
    line-height: var(--leading-relaxed);
    color: var(--gray-600);
}

.claims {
    display: grid;
    grid-template-columns: 1fr 1fr;
    gap: var(--space-5);
    margin-top: var(--space-8);
}

.claim-col {
    padding: var(--space-8);
    border-radius: var(--radius-lg);
    border: 1px solid var(--gray-200);
    background: white;
}

.claim-col.does {
    border-left: 3px solid var(--success);
}

.claim-col.does-not {
    border-left: 3px solid var(--error);
}

.claim-col h3 {
    font-size: var(--text-lg);
    font-weight: 700;
    color: var(--gray-900);
    margin-bottom: var(--space-5);
    display: flex;
    align-items: center;
    gap: var(--space-2);
}

.claim-col.does h3 i {
    color: var(--success);
    width: 18px;
    height: 18px;
}

.claim-col.does-not h3 i {
    color: var(--error);
    width: 18px;
    height: 18px;
}

.claim-col ul {
    list-style: none;
    display: flex;
    flex-direction: column;
    gap: var(--space-4);
}

.claim-col li {
    font-size: var(--text-base);
    line-height: var(--leading-relaxed);
    color: var(--gray-600);
    padding-left: var(--space-5);
    position: relative;
}

.claim-col li::before {
    content: '';
    position: absolute;
    left: 0;
    top: 0.55em;
    width: 6px;
    height: 6px;
    border-radius: 50%;
    background: var(--gray-300);
}

.claim-col.does li::before {
    background: var(--success);
}

.claim-col.does-not li::before {
    background: var(--error);
}

.claim-col li strong {
    color: var(--gray-900);
    font-weight: 600;
}

.prose-block {
    max-width: 76ch;
}

.prose-block h3 {
    font-size: var(--text-lg);
    font-weight: 700;
    color: var(--gray-900);
    margin-top: var(--space-8);
    margin-bottom: var(--space-3);
}

.prose-block p {
    font-size: var(--text-base);
    line-height: var(--leading-relaxed);
    color: var(--gray-600);
    margin-bottom: var(--space-4);
}

.prop-list {
    list-style: none;
    display: flex;
    flex-direction: column;
    gap: var(--space-4);
    margin: var(--space-6) 0;
}

.prop-list li {
    font-size: var(--text-base);
    line-height: var(--leading-relaxed);
    color: var(--gray-600);
    padding-left: var(--space-5);
    border-left: 2px solid var(--accent-500);
}

.prop-list li strong {
    color: var(--gray-900);
    font-weight: 600;
}

.prose-block strong {
    color: var(--gray-900);
    font-weight: 600;
}

@media (max-width: 900px) {
    .boundary-grid,
    .claims {
        grid-template-columns: 1fr;
    }
}
</style>

<section class="hero hero-page">
    <div class="hero-container">
        <div class="hero-badge">
            <i data-lucide="shield-check"></i>
            <span>Security model</span>
        </div>
        <h1>What Sandlock Guarantees, and What It Does Not</h1>
        <p class="subtitle">A sandbox is only useful if you know its edges: the trust boundaries, what each layer guarantees, and what is out of scope.</p>
        <p class="page-meta">By {{ page.author }} &middot; Updated <time datetime="{{ page.last_modified_at | date: '%Y-%m-%d' }}">{{ page.last_modified_at | date: "%B %-d, %Y" }}</time></p>
    </div>
</section>

<section class="section">
    <div class="section-container">
        <div class="section-header">
            <div class="section-badge">
                <i data-lucide="layers"></i>
                <span>Trust boundaries</span>
            </div>
            <h2 class="section-title">Three Tiers of Trust</h2>
            <p class="section-subtitle">Trust placed in userspace is kept as small as the policy allows.</p>
        </div>

        <div class="boundary-grid">
            <div class="boundary">
                <span class="tier">Fully trusted</span>
                <h3>The host kernel</h3>
                <p>Evaluates Landlock and seccomp. Sandlock shares it with the workload; if the kernel is compromised, so is every guarantee here.</p>
            </div>

            <div class="boundary">
                <span class="tier">Partially trusted</span>
                <h3>The supervisor</h3>
                <p>Runs in the parent, outside the sandbox, deciding the syscalls the kernel hands it. Built-in handlers run first, so a custom one can extend confinement but never relax it.</p>
            </div>

            <div class="boundary">
                <span class="tier">Untrusted</span>
                <h3>The workload</h3>
                <p>Assumed hostile. <code class="inline">NO_NEW_PRIVS</code>, Landlock, and seccomp are installed and inherited descriptors closed before <code class="inline">exec</code>, so it never runs unconfined.</p>
            </div>
        </div>
    </div>
</section>

<section class="section section-alt">
    <div class="section-container">
        <div class="section-header">
            <div class="section-badge">
                <i data-lucide="check-check"></i>
                <span>Scope</span>
            </div>
            <h2 class="section-title">In Scope and Out of Scope</h2>
        </div>

        <div class="claims">
            <div class="claim-col does">
                <h3><i data-lucide="shield-check"></i>Sandlock defends against</h3>
                <ul>
                    <li><strong>Filesystem escape.</strong> Only granted Landlock paths open; denials override grants.</li>
                    <li><strong>Unapproved network egress.</strong> Default deny: Landlock refuses TCP connects; seccomp refuses UDP, ICMP, and raw sockets.</li>
                    <li><strong>Exfiltration on an approved host.</strong> HTTP rules match method, host, and path.</li>
                    <li><strong>Credential theft.</strong> The secret stays in the supervisor and is attached after the ACL check.</li>
                    <li><strong>Escalation via setuid.</strong> <code class="inline">NO_NEW_PRIVS</code> makes a setuid binary confer nothing.</li>
                    <li><strong>Reaching sibling processes.</strong> Landlock v6 scopes deny abstract sockets and signals outside the sandbox.</li>
                    <li><strong>Host resource exhaustion.</strong> Memory, processes, open files, CPU share, and COW disk are capped.</li>
                    <li><strong>Unintended writes.</strong> Copy-on-write discards a failed run's writes.</li>
                </ul>
            </div>

            <div class="claim-col does-not">
                <h3><i data-lucide="shield-off"></i>Sandlock does not defend against</h3>
                <ul>
                    <li><strong>Kernel vulnerabilities.</strong> An escalation bug in a permitted syscall defeats the sandbox. That is the price of no hypervisor.</li>
                    <li><strong>Hardware side channels.</strong> Spectre-class and cache timing attacks. CPU pinning is not a mitigation.</li>
                    <li><strong>A policy that grants too much.</strong> Sandlock enforces the policy you wrote, not the one you meant.</li>
                    <li><strong>A hostile launcher.</strong> Whoever controls the process that starts Sandlock controls the policy.</li>
                    <li><strong>The workload starving itself.</strong> Limits protect the host, not the workload's progress.</li>
                    <li><strong>Open-file limits as a boundary.</strong> A privileged sandbox can raise <code class="inline">RLIMIT_NOFILE</code> again. It is a budget.</li>
                    <li><strong>Covert channels.</strong> Sandboxes on one host share timing, disk, and memory bandwidth.</li>
                    <li><strong>Packet crafting.</strong> Raw ICMP sockets are never exposed, deliberately.</li>
                </ul>
            </div>
        </div>
    </div>
</section>

<section class="section">
    <div class="section-container narrow">
        <div class="section-header left">
            <div class="section-badge">
                <i data-lucide="clock-alert"></i>
                <span>Design detail</span>
            </div>
            <h2 class="section-title">Time-of-Check to Time-of-Use</h2>
        </div>

        <div class="prose-block">
            <p><code class="inline">seccomp_unotify(2)</code> documents the hazard: after a continue verdict, <strong>the kernel re-reads any argument passed by pointer</strong>, so a path string a supervisor inspected can be overwritten before the kernel acts. Filtering on path strings in userspace is unsound, however carefully written. Sandlock addresses it two ways.</p>

            <h3>Path strings never reach policy callbacks</h3>
            <p>Events carry the syscall, PID, network destination, and argv, never a path. Path decisions belong in Landlock rules, which the kernel resolves at access time. Runtime decisions use <code class="inline">deny_path()</code> and <code class="inline">allow_path()</code>, which add Landlock restrictions rather than filtering strings.</p>

            <h3>argv is exposed, and made safe first</h3>
            <p>Before exposing <code class="inline">argv</code> for an <code class="inline">execve</code>, the supervisor <strong>freezes every task in its process index</strong>, including peers that could alias the memory. If the freeze cannot be established, for instance under a YAMA ptrace policy, <strong>the syscall is denied with <code class="inline">EPERM</code></strong>. The invariant is never silently relaxed.</p>
        </div>
    </div>
</section>

<section class="section section-alt">
    <div class="section-container narrow">
        <div class="section-header left">
            <div class="section-badge">
                <i data-lucide="toggle-left"></i>
                <span>Defaults</span>
            </div>
            <h2 class="section-title">Strict by Default, Explicit to Weaken</h2>
        </div>

        <div class="prose-block">
            <p>Sandlock starts from deny. A permissive default fails silently: you learn about the gap from an incident rather than an error.</p>
        </div>

        <div class="data-table-wrap" style="margin-top: var(--space-6);">
            <table class="data-table">
                <thead>
                    <tr>
                        <th scope="col">Surface</th>
                        <th scope="col">With no policy</th>
                        <th scope="col">To open it up</th>
                    </tr>
                </thead>
                <tbody>
                    <tr>
                        <th scope="row">Filesystem</th>
                        <td>Nothing readable or writable, not even <code>/usr</code>.</td>
                        <td>Name every path.</td>
                    </tr>
                    <tr>
                        <th scope="row">Network</th>
                        <td>No TCP connect; no UDP, ICMP, or raw socket creation.</td>
                        <td><code>--net-allow '*'</code> explicitly; ICMP needs its own <code>icmp://</code> rule.</td>
                    </tr>
                    <tr>
                        <th scope="row">Syscalls</th>
                        <td>The default blocklist, always.</td>
                        <td>Named groups only, such as System V IPC. A typo fails loudly.</td>
                    </tr>
                    <tr>
                        <th scope="row">Kernel protections</th>
                        <td>All enforced; Sandlock <strong>refuses to start</strong> if one is missing.</td>
                        <td>Per protection: <code>allow_degraded</code> or <code>disable</code>.</td>
                    </tr>
                </tbody>
            </table>
        </div>
        <p class="table-note">A sandbox's protection posture is part of its checkpoint, so a restore keeps the protections it was built with. <code>sandlock check</code> reports the host's Landlock ABI.</p>
    </div>
</section>

<section class="section">
    <div class="section-container narrow">
        <div class="section-header left">
            <div class="section-badge">
                <i data-lucide="key-round"></i>
                <span>Secrets</span>
            </div>
            <h2 class="section-title">Credential Handling</h2>
        </div>

        <div class="prose-block">
            <p>A workload can use a secret without holding it. The supervisor loads it from an environment variable, file, or descriptor and attaches it in the proxy <strong>strictly after the ACL check</strong>, so a rejected request never carries it.</p>

            <ul class="prop-list">
                <li><strong>The child never carries the value.</strong> An <code class="inline">env:</code> source is stripped from its environment; an <code class="inline">fd:</code> source never touches disk.</li>
                <li><strong>Cleartext HTTP warns.</strong> Attaching a credential over plain HTTP emits a one-per-run warning.</li>
                <li><strong>The CA key stays in memory.</strong> <code class="inline">--http-inject-ca</code> writes only the public certificate into the bundles you name.</li>
            </ul>

            <p>There is no secret-manager client, deliberately. Vault, a cloud store, or a CSI driver materializes the value into a <code class="inline">file:</code> or <code class="inline">fd:</code> source, off <code class="inline">ps</code> and out of shell history.</p>
        </div>
    </div>
</section>

<section class="section section-alt" id="research">
    <div class="section-container narrow">
        <div class="section-header">
            <div class="section-badge">
                <i data-lucide="book-open"></i>
                <span>Research</span>
            </div>
            <h2 class="section-title">Where This Threat Model Is Written Down</h2>
            <p class="section-subtitle">The guarantees above, and the attacks out of scope, are stated formally in the paper.</p>
        </div>

        <div class="research-list">
            <article class="research-item">
                <div class="research-kind">Paper</div>
                <h3><a href="https://arxiv.org/abs/2605.26298">Sandlock: Confining AI Agent Code with Unprivileged Linux Primitives</a></h3>
                <p class="research-meta">Cong Wang and Yusheng Zheng. arXiv:2605.26298, May 2026.</p>
                <blockquote>&ldquo;It also supports dynamic network decisions, HTTP-level access control, TOCTOU-safe inspection of execve arguments, and reversible filesystem effects. On our workstation, Sandlock adds roughly 5 ms of startup overhead and runs Redis at bare-metal throughput (within measurement noise).&rdquo;</blockquote>
            </article>
            <article class="research-item">
                <div class="research-kind">Engineering post</div>
                <h3><a href="https://multikernel.io/2026/03/14/introducing-sandlock/">Processes Are All You Need for AI Sandboxing</a></h3>
                <p class="research-meta">Multikernel Technologies, March 2026. Why a process, not a container or a VM, is the right unit of confinement for agent tool calls.</p>
            </article>
            <article class="research-item">
                <div class="research-kind">Engineering post</div>
                <h3><a href="https://multikernel.io/2026/03/19/sandlock-cow-fork/">1,000 Sandboxes in 718 Milliseconds: Copy-on-Write Forking for AI Agents</a></h3>
                <p class="research-meta">Multikernel Technologies, March 2026. How COW fork clones a running sandbox in about 530 &micro;s.</p>
            </article>
            <article class="research-item">
                <div class="research-kind">Engineering post</div>
                <h3><a href="https://multikernel.io/2026/04/03/ai-agent-sandboxes-got-security-wrong/">AI Agent Sandboxes Got Security Wrong</a></h3>
                <p class="research-meta">Multikernel Technologies, April 2026. The case for allowlists over isolation boundaries.</p>
            </article>
        </div>
    </div>
</section>

<section class="section section-dark">
    <div class="section-container narrow">
        <div class="section-header">
            <div class="section-badge">
                <i data-lucide="bug"></i>
                <span>Disclosure</span>
            </div>
            <h2 class="section-title">Reporting a Vulnerability</h2>
            <p class="section-subtitle">Found a way out of a Sandlock policy? We want to hear it first.</p>
        </div>

        <div class="text-center">
            <p style="color: rgba(255,255,255,0.6); font-size: var(--text-base); line-height: var(--leading-relaxed); max-width: 60ch; margin: 0 auto var(--space-8);">
                Email <a href="mailto:contact@multikernel.io" style="color: var(--accent-400)">contact@multikernel.io</a> with a reproducer where possible. Please do not open a public issue until we have responded.
            </p>
            <div class="button-group">
                <a href="mailto:contact@multikernel.io" class="btn btn-primary">
                    <i data-lucide="mail"></i>
                    Report Privately
                </a>
                <a href="https://github.com/multikernel/sandlock/issues" target="_blank" rel="noopener noreferrer" class="btn btn-secondary">
                    <i data-lucide="github"></i>
                    Non-Security Issues
                </a>
            </div>
        </div>
    </div>
</section>