Privilege separation

Privilege separation

Sanctum is the only ISC licensed, free and open VPN software in the world designed from the ground up in a fully privilege separated way.

Multi-process

Sanctum is built using a multi-process approach where each process is only doing one thing. This allows for more fine-grained sandboxing in relation to permissions or allowed system calls. Packets flow between these processes in a well-defined manner making it impossible to move a packet straight from the red side to the black side without passing the encryption process and vice-versa.

Sandbox

Its unique privilege separation design in combination with strong modern sandboxing guarantee that all of its important assets are separated from processes that talk to the internet or handle non-cryptography related things. Each process receives its own sandbox with only the system calls it requires to function and only access to the files it needs.

Packet flow

The processes share packets between each other in a very well defined way. For incoming packets:

purgatory-rx (black) -> confess (decryption) -> heaven-tx (red)

For outgoing packets:

heaven-rx (red) -> bless (encrypt) -> purgatory-tx (black)

When the processes start they will remove any of the queues they do not need for operating making sure only the correct processes have access to the queues they require.

Processes

Below is a list of all the processes that make up sanctum and their responsibility, what processes are active is determined by what mode sanctum runs under. For example: pilgrim (the sender mode for one-way tunnels) does not have the heaven-tx or purgatory-rx processes active, meaning it is impossible for it to receive any packets.