read about API hooking, for example sandboxie hooks Windows kernel to filter all api calls to filesystem and redirects it results to sandbox, you could hook APIs and filter it, pass only valid parameters, return errors for invalid calls

for API hooking you will find plenty materials on the net, try on codeproject.com

Google s Chromium uses sandboxing and has several documents about it:

• http://dev.chromium.org/developers/design-documents/sandbox
• http://code.google.com/p/chromium/wiki/LinuxSandboxing

You might also look at jails in FreeBSD. These are the FreeBSD equivalent of sandboxes.

The source code for jail is available (though you ll have to understand the rest of the FreeBSD code as well.)

A simple sandbox would simply be an environment in which you let something execute, but restrict what it can do.

Typically, this "something" is an already-existing language, like Java, or JavaScript, or C#, or native code. Java has sandboxing apis for applets and so on, and .NET has various trust levels, JavaScript has the bounds placed on it by the interpreters (browsers).

So it s a little weird to "write" your own sandbox unless you also have a language you want to sandbox.

Do you have such a language? What do you want to learn about, specifically?

This is very dependent on what do you want to sandbox. If it is a full-blown system with multiple interfaces/languages available, you really do not want to re-invent the wheel, but run a virtual machine in VirtualBox, QEmu or some other alternative

In any case, a sandbox IS, at least on some level a virtualization of the system you are supposed to be running...

If you need to sandbox applications for a single (interpreted) language, modifying the interpreter sound like a sensible approach.

The answer will likely be language specific. Unfortunately most languages don t have built-in sandboxing capabilities. But functional languages tend to be powerful enough that one can be built from scratch without extending the language.

In Tcl the basic mechanism is to create slave interpreters:

interp create -safe sandbox
interp eval sandbox $set_up_code
set result [interp eval sandbox $unsafe_code]

I wrote an overview of the ways of sandboxing within Linux the other day, which links to a lot of references for the different techniques. Similar methods are applicable in other operating systems. I hope it is helpful - I couldn t find much comprehensively documented either.