{"id":157098,"date":"2026-02-05T17:11:56","date_gmt":"2026-02-05T15:11:56","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/microsoft-razvivaet-otkrytuyu-sistemu-sandbox-izolyaczii-litebox"},"modified":"2026-02-05T17:11:56","modified_gmt":"2026-02-05T15:11:56","slug":"microsoft-razvivaet-otkrytuyu-sistemu-sandbox-izolyaczii-litebox","status":"publish","type":"post","link":"https:\/\/prohoster.info\/pl\/blog\/news\/microsoft-razvivaet-otkrytuyu-sistemu-sandbox-izolyaczii-litebox","title":{"rendered":"Microsoft is developing an open sandbox isolation system called Litebox","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
James Morris, maintainer of the Linux kernel security subsystem and head of the 'Linux Emerging Technologies' team at Microsoft, introduced the Litebox project, positioned as a security-focused operating system in the form of a Library OS. Litebox can be used in programs or kernels as an additional layer of isolation, blocking access to unnecessary kernel functionality or APIs to reduce the attack surface. The project's code is written in Rust and is open-sourced under the MIT license. <\/p>\n
The idea of 'Library OS' is that operating system services are directly embedded into the application instead of calling an external OS kernel through system calls. In the context of Litebox, an isolating layer connects to applications, providing a minimal platform that translates requests to an external full-featured API. Such external interfaces can include the Linux kernel, protected isolated environments like OP-TEE (Open Portable Trusted Execution Environment), WebAssembly environments, or the standard Rust Std library.
<\/center> <\/p>\n
The minimal platform formed via Litebox is applicable for running Linux, Windows, and FreeBSD applications, embedded Linux kernels, and LVBS (Linux Virtualization Based Security). Potential use cases for Litebox include enabling unmodified Linux programs to run in Windows, isolating Linux applications on systems with a Linux kernel, running programs over AMD SEV SNP for memory encryption, executing OP-TEE programs in Linux, and isolation using the LVBS concept. <\/p>\n
The LVBS project, whose representatives participate in the development of Litebox, is developing methods to protect Linux kernel components by utilizing hypervisor capabilities and hardware virtualization. For instance, using a hypervisor, operations for authenticating modules, verification, and managing access to passwords, keys, kernel structures, and other critical resources can be isolated. In the event of a vulnerability exploitation and kernel compromise, an attacker would not be able to access such resources, as their handlers operate outside the current privilege level. Litebox is viewed in the context of the LVBS project as a 'secure kernel' that protects the regular kernel of the guest system through hardware virtualization. \n \u0179r\u00f3d\u0142o: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
![\"Microsoft](\"\/wp-content\/uploads\/2026\/02\/38d3b2756c97daf52fff8b023baed412.png\")
<\/center> <\/p>\n