微软开源 LiteBox，一个注重安全的库操作系统。

微软开源 LiteBox，一个注重安全的库操作系统。
Microsoft open-sources LiteBox, a security-focused library OS

原始链接: https://github.com/microsoft/litebox

LiteBox是一个注重安全的沙盒操作系统库，旨在通过大幅减少与宿主系统交互来最小化攻击面。目前正在积极开发中，它优先考虑“北向”垫片（类似于nix/rustix的Rust风格API）与“南向”平台（底层操作系统）之间的灵活互操作性。这使得LiteBox能够在内核和非内核环境中运行，从而实现多种用例，例如在Windows上运行Linux程序、沙盒化应用程序以及利用SEV SNP和OP-TEE等安全硬件。该项目是开源的（MIT License），并鼓励实验，但需要长期稳定性的用户应注意，在达到稳定版本之前，API可能会发生变化。它也承认有关微软和其他第三方徽标的潜在商标限制。

微软已开源 LiteBox，这是一款注重安全的库操作系统，旨在通过大幅减少主机接口来最小化攻击面。项目负责人 James Morris 宣布，LiteBox 促进了各种“北向”垫片（如受 nix/rustix 启发的 Rust 接口）和“南向”平台之间的互操作性。这使得各种用例成为可能，包括在 Windows 上运行 Linux 程序、在 Linux 上沙箱化应用程序，以及利用 SEV SNP 和 OP-TEE 等安全执行环境。该项目适用于内核和非内核场景。 Hacker News 上的讨论指出，其依赖项列表很长（`cargo.lock` 文件超过 2200 行），引发了对审计的疑问，并且有一些评论标记了潜在的机器人活动。更多信息和讨论可以在 Reddit 和 social.kernel.org 上找到。

原文

A security-focused library OS

Note

This project is currently actively evolving and improving. While we are working toward a stable release, some APIs and interfaces may change as the design continues to mature. You are welcome to explore and experiment, but if you need long-term stability, it may be best to wait for a stable release, or be prepared to adapt to updates along the way.

LiteBox is a sandboxing library OS that drastically cuts down the interface to the host, thereby reducing attack surface. It focuses on easy interop of various "North" shims and "South" platforms. LiteBox is designed for usage in both kernel and non-kernel scenarios.

LiteBox exposes a Rust-y nix/rustix-inspired "North" interface when it is provided a Platform interface at its "South". These interfaces allow for a wide variety of use-cases, easily allowing for connection between any of the North--South pairs.

Example use cases include:

Running unmodified Linux programs on Windows
Sandboxing Linux applications on Linux
Run programs on top of SEV SNP
Running OP-TEE programs on Linux
Running on LVBS

See the following files for details:

MIT License. See ./LICENSE for details.

This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft trademarks or logos is subject to and must follow Microsoft's Trademark & Brand Guidelines. Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship. Any use of third-party trademarks or logos are subject to those third-party's policies.

微软开源 LiteBox，一个注重安全的库操作系统。 Microsoft open-sources LiteBox, a security-focused library OS

微软开源 LiteBox，一个注重安全的库操作系统。
Microsoft open-sources LiteBox, a security-focused library OS