{"id":157098,"date":"2026-02-05T17:11:56","date_gmt":"2026-02-05T15:11:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/microsoft-razvivaet-otkrytuyu-sistemu-sandbox-izolyaczii-litebox"},"modified":"2026-02-05T17:11:56","modified_gmt":"2026-02-05T15:11:56","slug":"microsoft-razvivaet-otkrytuyu-sistemu-sandbox-izolyaczii-litebox","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/microsoft-razvivaet-otkrytuyu-sistemu-sandbox-izolyaczii-litebox","title":{"rendered":"Microsoft is developing an open Sandbox isolation system called Litebox","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
James Morris, the maintainer of the Linux kernel security subsystem and head of Microsoft's 'Linux Emerging Technologies' team, introduced the Litebox project, marketed as a security-focused operating system in the form of a Library OS. Litebox can be used in applications or kernels as an additional layer of isolation, blocking access to excessive functionality of kernels or APIs to reduce the attack surface. The project's code is written in Rust and is open-sourced under the MIT license. <\/p>\n
The idea of a 'Library OS' is that operating system services are embedded directly into the application instead of calling an external OS kernel via system calls. In the context of Litebox, an isolating layer is connected to applications, providing a minimal platform that translates requests to an external fully functional programming interface. Such external interfaces may include the Linux kernel, secure isolated environments OP-TEE (Open Portable Trusted Execution Environment), WebAssembly environments, or the standard Rust library.
<\/center> <\/p>\n
The minimal platform provided by Litebox is applicable for running applications on Linux, Windows, and FreeBSD, including nested Linux kernels and Linux Virtualization Based Security (LVBS). Potential applications of Litebox include running unmodified Linux programs on Windows, isolating the execution of Linux applications on systems with a Linux kernel, executing programs over AMD SEV SNP for memory encryption, running OP-TEE programs in Linux, and using isolation based on the LVBS concept. <\/p>\n
The LVBS project, whose representatives are involved in the development of Litebox, is advancing methods to protect components of the Linux kernel by utilizing hypervisor and hardware virtualization capabilities. For example, using a hypervisor, the operations for authenticating modules, verification, and controlling access to passwords, keys, kernel structures, and other critical resources can be isolated. In the event of a vulnerability exploitation and kernel compromise, an attacker would not be able to access such resources, as their handlers operate outside the current privilege level. Litebox is considered within the framework of the LVBS project as a 'secure kernel', protecting the regular kernel of the guest system through hardware virtualization. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
![\"Microsoft](\"\/wp-content\/uploads\/2026\/02\/38d3b2756c97daf52fff8b023baed412.png\")
<\/center> <\/p>\n