How would one program a sandbox?
Let's say the server and all clients have the same architecture,
and environment (for example 32bit x86-Linux environment).
The server shall offer sandbox services to clients.
A remote client can get a sandbox (an empty directory space)
on the server, upload his precompiled executable program,
start it, and then disconnect. When the program finishes
then the sandbox server sends a notification to the
email adress of the client.
Then the client can connect to the sandbox and
pick up the result file.
So, there is no need for manual login; everything should be
done programmatically via an agreed upon protocol (API).
The main problem here is security and safety.
The client program shall not be able to access any
other directories on the server except its own directory
and the subdirectories it can create therein.
And, the sandbox client shall be allowed to use only some
predetermined services, ie. only those that were explicitly
allowed him to use, for example a specific tcp port
and a specific ip-adress. And disc space, memory,
and the # of file handles the user can use shall be restricted too.
These limits are mainly for protecting the server itself
from possible bad code of the clients.
Ie. the sandbox server shall execute the program of the
client in a controlled manner by ensuring that the client program
does no harm to the server and also that the client program
does not get access to other areas and services of the system
beyond the sandbox. And that the client does not use all the
disc space, ram, file handles, CPU priority, network bandwidth etc.
Performance is important. The client wants to run his number-crunching
program on the server because it is a much faster machine.
Is such a sandbox server feasable and if yes, what would one need
for developing such a safe&secure sandbox server?
Can this be realized in C/C++ or does one need also assembler programming,
if yes then how much % of the code would be needed to be done in assembler?
