  Network services are among the riskiest programs executed by production
systems. Such services execute large quantities of complex code and process
data from arbitrary and untrusted network sources, often with high levels of
system privilege. It is desirable to confine system services to a
least-privileged environment so that the potential damage from a malicious
attacker can be limited, but existing mechanisms for sandboxing services
require invasive and system-specific code changes and are insufficient to
confine broad classes of network services.
  Rather than sandboxing one service at a time, we propose that the best place
to add sandboxing to network services is in the service manager that starts
those services. As a first step towards this vision, we propose CapExec, a
process supervisor that can execute a single service within a sandbox based on
a service declaration file in which, required resources whose limited access to
are supported by Caper services, are specified. Using the Capsicum
compartmentalization framework and its Casper service framework, CapExec
provides robust application sandboxing without requiring any modifications to
the application itself. We believe that this is a first step towards ubiquitous
sandboxing of network services without the costs of virtualization.
  Keywords: application security, sandboxing, service manager, Capsicum,
compartmentalization
