CAJ | 학술논문

文章设计了一个具有自己独立工作目录的Linux应用沙箱，可为用户对不信任的应用程序提供一个独立和安全的运行环境，应用程序在沙箱中所做的操作对主机不会造成任何影响。该沙箱提供了文件系统隔离、系统资源隔离、物理资源隔离、权能限制和强制访问控制(Mandatory Access Control，MAC)等策略，添加了地址随机化、不可执行页保护等内存保护安全策略。与已有沙箱对比，文章设计的沙箱增加了多种安全机制，提高了系统的安全性，保护了系统的数据安全和用户的个人隐私等。
문장설계료일개구유자기독립공작목록적Linux응용사상，가위용호대불신임적응용정서제공일개독립화안전적운행배경，응용정서재사상중소주적조작대주궤불회조성임하영향。해사상제공료문건계통격리、계통자원격리、물리자원격리、권능한제화강제방문공제(Mandatory Access Control，MAC)등책략，첨가료지지수궤화、불가집행혈보호등내존보호안전책략。여이유사상대비，문장설계적사상증가료다충안전궤제，제고료계통적안전성，보호료계통적수거안전화용호적개인은사등。
Linux application sandbox is designed for providing an independent, secure operating environment for untrusted applications. The sandbox has its own independent working directory, and the operation of applications in the sandbox has no impact on the host. The sandbox provides iflesystem isolation, system resources isolation, physical resources isolation, capabilities limits and mandatory access control (MAC) policies, adding memory protection policies like address randomization and non-executable memory page protection. The sandbox increases several security mechanisms relative to existing sandboxes, improving the system security and protecting the system and user’s personal privacy.