Feature request: Simple CLI tool for running executables in a sandbox

[rgwood]

Right now, this project seems focused on letting developers opt in to MSIX-dependent sandboxing for their own applications. I would like to use the sandbox in a different way: to restrict what arbitrary executables can do.

On Linux, Justine Tunney's BSD-inspired pledge tool is extremely useful; it can be used to launch arbitrary executables inside a sandbox. For example, if you want to run ls and only permit it to do basic stdio (-p stdio) and filesystem path (-p rpath) reading in the current directory (-v .), then you'd say:

pledge -v . -p 'stdio rpath' ls

It would be super useful to have something similar on Windows. I would use it for things like:

• limiting what sketchy executables can do
• fuzz testing (it helps limit what an application can do if given dangerous input)

[ddsilva-msft]

Hey @rgwood, you could specify a manifest with no capabilities to limit the access of arbitrary executables to the access that AppContainers are granted by default. We don't currently support a sandbox more restrictive than that.

[rgwood]

Am I correct in understanding that that would require taking the executable, packaging it via MSIX, and installing the package?

That could work but it would be orders of magnitude more hassle than a tool like pledge.

[ddsilva-msft]

Yes, that's correct, this would require packaging. We'll get the request for a command line tool added to our backlog.