How does a sandbox module know the difference between trusted and untrusted code

Question

What criteria does a sandbox use to determine whether executing code (registry read/write) can be trusted or not ?

Answer 1

A well-designed sandbox is simple: all code inside it is untrusted, and has to ask the sandbox if it wants access to anything outside.

Answer 2

A sandbox is an environment which restricts what the code can do. Such restrictions might for example limit file access to specific directories, network access to specific IP or ports or use of system calls to only white listed ones. What kind of restrictions are setup for the sandbox depends on the specific use case.

And because the sandbox restricts what code can do it can be used to execute untrusted code, i.e. code which might be harmful when run within an unrestricted environment. In other words: the sandbox does not distinguish between untrusted and trusted code. Instead every code inside the sandbox is considered untrusted and that's the reason it will be run inside a sandbox in the first place.

There are many different use cases for sandboxes and also many different implementations. For example a program might put itself or its children in a restricted environment (see chroot, pledge or seccomp for examples) in order to limit the damage which can be done in case of bugs in the program. Or an antivirus product might put some suspicious software in a sandbox in order to monitor and restrict its behavior. Or you have a sanboxed execution of Javascript inside the browser which limits what kind of resources the script can access and with which sites it can communicate.