Sandboxing mechanisms allow developers to limit how much access applications have to resources, following the least-privilege principle. However, it's not clear how much and in what ways developers are using these mechanisms. This study looks at the use of Seccomp, Landlock, Capsicum, Pledge, and Unveil in all packages of four open-source operating systems. We found that less than 1% of packages directly use these mechanisms, but many more indirectly use them. Examining how developers apply these mechanisms reveals interesting usage patterns, such as cases where developers simplify their sandbox implementation. It also highlights challenges that may be hindering the widespread adoption of sandboxing mechanisms.

翻译：沙箱机制遵循最小权限原则，允许开发者限制应用程序对资源的访问权限。然而，目前尚不清楚开发者使用这些机制的程度及方式。本研究考察了四款开源操作系统中所有软件包对Seccomp、Landlock、Capsicum、Pledge及Unveil五种沙箱机制的使用情况。研究发现，直接使用这些机制的软件包占比不足1%，但通过间接方式使用的数量则显著增多。通过分析开发者应用这些机制的具体方式，我们发现了有趣的模式，例如部分开发者会简化其沙箱实现。同时，研究也揭示了可能阻碍沙箱机制广泛采用的关键挑战。