[GH-ISSUE #12] Feature request: Add support for sandboxing #308

New issue

Open

opened 2026-03-15 21:52:09 +03:00 by kerem · 4 comments

kerem commented

2026-03-15 21:52:09 +03:00

Owner

Originally created by @pwrdwnsys on GitHub (Jun 2, 2016).
Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/12

It would be useful to have support for sandboxing trust-dns, in particular decoding of requests.

rusty-sandbox offers an abstraction layer over the sandboxing mechanisms provided by several operating systems, and could be incorporated as an optional compile-time feature.

Originally created by @pwrdwnsys on GitHub (Jun 2, 2016). Original GitHub issue: https://github.com/hickory-dns/hickory-dns/issues/12 It would be useful to have support for sandboxing trust-dns, in particular decoding of requests. [rusty-sandbox](https://github.com/myfreeweb/rusty-sandbox) offers an abstraction layer over the sandboxing mechanisms provided by several operating systems, and could be incorporated as an optional compile-time feature.

kerem added the

labels

2026-03-15 21:52:09 +03:00

kerem commented

2026-03-15 21:52:20 +03:00

Author

Owner

@bluejekyll commented on GitHub (Jun 2, 2016):

Looks like Linux support is lacking. I don't have a good way to test the other OSes right now. If I incorporate this is it something you could test? I really like the idea.

@bluejekyll commented on GitHub (Jun 2, 2016): Looks like Linux support is lacking. I don't have a good way to test the other OSes right now. If I incorporate this is it something you could test? I really like the idea.

kerem commented

2026-03-15 21:52:25 +03:00

Author

Owner

@pwrdwnsys commented on GitHub (Jun 2, 2016):

Yes, happy to do some testing. I can test against OS X and FreeBSD, and can also test against OpenBSD when rusty-sandbox's pledge support is completed.

@pwrdwnsys commented on GitHub (Jun 2, 2016): Yes, happy to do some testing. I can test against OS X and FreeBSD, and can also test against OpenBSD when rusty-sandbox's pledge support is completed.

kerem commented

2026-03-15 21:52:30 +03:00

Author

Owner

@phillipCouto commented on GitHub (Aug 28, 2016):

On linux wouldn't the tools like selinux, systemd, and apparmor provide very similar features without the application being coded with sandbox logic?

Also there is no support for windows in rust-sandbox or the mentioned gaol library either. For completeness isn't this something to consider as well?

@phillipCouto commented on GitHub (Aug 28, 2016): On linux wouldn't the tools like selinux, systemd, and apparmor provide very similar features without the application being coded with sandbox logic? Also there is no support for windows in rust-sandbox or the mentioned gaol library either. For completeness isn't this something to consider as well?

kerem commented

2026-03-15 21:52:35 +03:00

Author

Owner

@bluejekyll commented on GitHub (Aug 28, 2016):

I have done zero research on this. selinux, apparmor, even docker/lxc, would be fine methods of sandboxing the process.

@bluejekyll commented on GitHub (Aug 28, 2016): I have done zero research on this. selinux, apparmor, even docker/lxc, would be fine methods of sandboxing the process.

kerem referenced this issue

2026-03-15 22:29:06 +03:00

[GH-ISSUE #308] Is trust_dns_server sync or async? #436

kerem referenced this issue

2026-03-15 22:29:06 +03:00

[GH-ISSUE #309] The RequestHandler should return a future #438