Disable sandbox via shared-library hijacking

This does the opposite of libsandbox

Supported sandboxes:

• FreeBSD capsicum
• OpenBSD pledge
• Illumos privileges
• Linux
  • landlock
  • prctl
  • seccomp
  • SELinux

Usage

make
SYSTEM=$(uname -s)
LD_PRELOAD=$PWD/$SYSTEM/libunsandbox.so program [options] [arguments]

See ld.so(8) manpage for alternatives to LD_PRELOAD

BUGS / Limitations

• Doesn't support statically compiled binaries
• Doesn't support setuid/setgid binaries
• Doesn't work on HardenedBSD unless the hardening.harden_rtld sysctl is set to zero
• Illumos still use some 32-bits binaries in userland and you may get wrong ELF class: ELFCLASS64