All projects

OS Security Research · NYU · 2025

Lind Sandbox: Rust Research

Contributor to Lind, NYU's OS-level sandboxing research project: a restricted POSIX environment that safely executes untrusted code by running it through WebAssembly.

  • Rust
  • WebAssembly
  • POSIX
  • Sandboxing
  • NYU

Approach

Lind's core idea is the "lock-in-pop" model — route all system interaction through a small, heavily-audited kernel interface subset, on the theory that commonly-used kernel paths are the well-tested ones. My work there is in Rust, on the runtime that enforces that boundary.

The project directly informed my xv6 security work — both are about deciding exactly how much kernel surface untrusted code is allowed to reach.

Highlights

  • Rust contributions to the lind-wasm runtime
  • POSIX-subset interface for sandboxed execution
  • WebAssembly as the isolation boundary for native code
  • Part of NYU's systems security research group

Artefacts