For example, in the Gentoo world we use it so we can build applications as root

For example, in the Gentoo world we use it to build applications as root

and make sure that the build system does not do crazy things outside of its

while making sure that the build system does not do crazy things outside of its

build directory.  Such as install files to the live root file system or modify

build directory (such as install files to the live root file system or modify

config files on the fly.

config files on the fly).

The way sandbox works is that you prime a few environment variables (in order

Sandbox works by priming a few environment variables (in order to control

to control the sandbox's behavior) and then stick it into the LD_PRELOAD

the sandbox's behavior) then inserting its own libsandbox.so into

variable.  Then when the ELF loader runs, it will first load the sandbox

the LD_PRELOAD variable.  This will cause the ELF loader to first load

library.  Whenever an applications makes a library call that we have wrapped,

the sandbox library.  Whenever an application makes a library call that

we'll check the arguments against the environment settings.  Based on that, any

has been wrapped, the arguments will be checked against the environment

access that is not permitted is logged and we return an error to the

settings.  Based on that, any access that is not permitted is logged and

application.  Any access that is permitted is of course forwarded along to the

will return an error to the application.  Any access that is permitted

real C library.

will, of course, be forwarded along to the real C library.