{"id":157098,"date":"2026-02-05T17:11:56","date_gmt":"2026-02-05T15:11:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/microsoft-razvivaet-otkrytuyu-sistemu-sandbox-izolyaczii-litebox"},"modified":"2026-02-05T17:11:56","modified_gmt":"2026-02-05T15:11:56","slug":"microsoft-razvivaet-otkrytuyu-sistemu-sandbox-izolyaczii-litebox","status":"publish","type":"post","link":"https:\/\/prohoster.info\/hu\/blog\/news\/microsoft-razvivaet-otkrytuyu-sistemu-sandbox-izolyaczii-litebox","title":{"rendered":"A Microsoft fejleszti a ny\u00edlt Litebox sandbox-izol\u00e1ci\u00f3s rendszert","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
James Morris, a maintainer of the Linux kernel security subsystem and head of the 'Linux Emerging Technologies' team at Microsoft, presented the Litebox project, positioned as a security-focused operating system in the form of a Library OS. Litebox can be used in applications or kernels as an additional isolation layer, blocking access to excessive functionality of kernels or APIs to reduce the attack surface. The project's code is written in Rust and is open under the MIT license. <\/p>\n
The idea of 'Library OS' is that operating system services are directly embedded into the application instead of accessing an external OS kernel via system calls. In the context of Litebox, an isolating layer is connected to the applications, providing a minimal platform that translates requests to an external fully functional API. Such external interfaces can include the Linux kernel, protected isolated environments like OP-TEE (Open Portable Trusted Execution Environment), WebAssembly environments, or the standard Rust library.
<\/center> <\/p>\n
The minimal platform formed through Litebox is applicable for running Linux, Windows, and FreeBSD applications, nested Linux kernels, and LVBS (Linux Virtualization Based Security). Potential use cases for Litebox include enabling the launch of unmodified Linux programs on Windows, isolating the execution of Linux applications on systems with a Linux kernel, running programs over AMD SEV SNP for memory encryption, executing OP-TEE programs in Linux, and isolation using the LVBS concept. <\/p>\n
The LVBS project, whose representatives are involved in the development of Litebox, develops methods for protecting components of the Linux kernel using the capabilities of hypervisors and hardware virtualization. For example, a hypervisor can isolate operations for authenticating modules, verification, and managing access to passwords, keys, kernel structures, and other critical resources. In the event of a vulnerability exploitation and kernel compromise, an attacker would not be able to access such resources since their handlers execute outside the current privilege level. Litebox is viewed within the LVBS project context as a 'secure kernel' that protects the regular kernel of the guest system through hardware virtualization. \n Forr\u00e1s: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
![\"A](\"\/wp-content\/uploads\/2026\/02\/38d3b2756c97daf52fff8b023baed412.png\")
<\/center> <\/p>\n