Language Runtimes · Cluster
Runtime Security
Sandboxing, capability models, and isolation.
- 01 The Runtime as Reference Monitor: Mediation and the Trusted Base How an interpreter or managed runtime becomes the enforcement point for security policy, which operations escape its mediation, and what the resulting trusted computing base contains.
- 02 Capability References and the Absence of Ambient Authority Why naming a resource by path or file descriptor grants more than the caller needs, and how unforgeable references make authority a property of what a program holds rather than who it claims to be.
- 03 Syscall Filtering and the Process as a Security Boundary How seccomp filters restrict a process to a fixed set of system calls, why argument inspection is limited by the kernel interface, and where the remaining escape routes lie.
- 04 Linearity and Aliasing as a Confinement Discipline How unique ownership, borrowing, and linear types let a compiler prove that a value crosses a boundary exactly once, and where the proof stops being able to say anything about authority.
- 05 WebAssembly Imports as the Only Channel to the Host Why a validated module can reach nothing but its own linear memory and its declared imports, and how host functions, tables, and shared memories widen that surface.
- 06 Deserialization as Re-entry Across the Trust Boundary Why parsing untrusted bytes into objects is the most exposed operation a runtime performs, how format-directed object construction grants authority, and which design choices contain the damage.
- 07 Attenuation and Revocation of Delegated Authority How a capability can be narrowed before it is passed on, why revocation in a capability system is either impossible or requires indirection, and what each indirection costs.
- 08 Fault Isolation Between Tenants in One Address Space How software-based isolation keeps untrusted modules in a shared heap using reservations, per-tenant heaps, and checks, and why the hardware offers no help with cross-tenant reads.
- 09 Covert Channels That Survive Logical Isolation Why a sandbox that prevents every direct access can still carry information through shared caches, timing, and resource contention, and what the bandwidth of each channel implies for policy.
- 10 What a Sandbox Proof Establishes and What It Assumes How verification of a sandbox reduces the isolation guarantee to a set of machine-checked lemmas, where the specification gap appears, and why the assumptions are the part that matters.