/home/alip                                                                      -bash-5.2$ # Let's try to call an external function                             -bash-5.2$ ls                                                                   {"cap":"p","cmd":"-bash","ctx":"access","cur":1,"cwd":"/home/alip","id":"syd","l:1000}                                                                          -bash: fork: Permission denied                                                  -bash-5.2$ # Let's try to spawn a subshell                                      -bash-5.2$ ( echo hello world )                                                 {"cap":"p","cmd":"-bash","ctx":"access","cur":1,"cwd":"/home/alip","id":"syd","l:1000}                                                                          -bash: fork: Permission denied                                                  -bash-5.2$ # All works as expected!                                             -bash-5.2$                                                                      logout                                                                          alip@pink ~ $ #                                                                 

alip@SydB☮x ~ $                                                                 alip@SydB☮x ~ $ # Looks good! I should prepare for snow :)                      alip@SydB☮x ~ $ # Let's disallow the address back again.                        alip@SydB☮x ~ $ esyd disallow_net --connect '5.9.243.187!80' # Note the quoting {"cfg":"allowlist/net/connect-5.9.243.187!80","cmd":"-bash","ctx":"config","cwd"1000}                                                                           alip@SydB☮x ~ $ curl wttr.in/Berlin # This is not going to work                 {"cfg":"allowlist/net/connect+0.0.0.0!35495","cmd":"curl wttr.in/Berlin","ctx":"134120,"uid":1000}                                                                                                                                              {"addr":"5.9.243.187!80","cap":"c","cmd":"curl wttr.in/Berlin","ctx":"access","c"uid":1000}                                                                     curl: (7) Failed to connect to wttr.in port 80 after 847 ms: Couldn't connect toalip@SydB☮x ~ $                                                                 alip@SydB☮x ~ $ # Allowlisting IP addresses it not al                           

alip@pink ~ $ # Let's start with a process that can work under low memory.      alip@pink ~ $ # How about busybox? Yes!                                         alip@pink ~ $ file $(which busybox)                                             /usr/host/bin/busybox: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), stat8d49cfa86a259e044f25ee84750927bfc5, stripped                                    alip@pink ~ $ # All nice and static linked.                                     alip@pink ~ $ syd -puser -msandbox/mem:on -mmem/max:7M busybox sh # Let's drop t~ $ bash                                                                        {"cap":"m","cmd":"bash /usr/host/bin/neofetch --no_config","ctx":"access","cur":d","l":2,"max":7000000,"pid":13,"sys":"mmap","t":1701801218,"uid":1000}         alip@SydB☮x ~ $ # Nice, bash worked but neofetch failed on a memory error.      alip@SydB☮x ~ $                                                                 exit                                                                            ~ $ # Let's get the memory a bit tighter.                                       ~ $