Systrace
|
|
Systrace is a computer security utility which monitors and limits an applications access to the system by enforcing access policies for system calls under various Unix-like operating systems. This is particularly useful when running untrusted or binary-only applications. Systrace also provides facilities for privilege elevation on a system call basis, which eliminates the need for potentially dangerous setuid applications. Systrace also implements interactive and automatic policy generation features, which are useful for creating a base policy for an application.
Systrace can mitigate the effects of buffer overflows and other security vulnerabilities by restricting the system calls and arguments available to an application.
As of 2004, systrace is integrated into NetBSD and OpenBSD. It is also available for Linux and Mac OS X, although the OS X port is currently unmaintained.
External link
- Systrace webpage (http://www.systrace.org/)