Verona's Process-Based Sandbox: Securely Running Untrusted Code

This project details a process-based sandbox mechanism for Verona, designed to safely execute untrusted external code. Leveraging process isolation, it requires no OS modifications, running untrusted libraries in a shared memory region and communicating with a trusted parent process via a carefully designed IPC. The mechanism supports callbacks and system call emulation, ensuring parent process safety; even if compromised, the sandbox cannot access parent memory or system resources. Currently supporting Capsicum and seccomp-bpf sandboxing technologies, the project aims to improve efficiency and compatibility.