Boot firmware sandboxing

A method, comprising:

• performing, by a bootloader, a boot sequence to initialize an operating system of a computing device;
• during the boot sequence:
• detecting, by the bootloader, a device driver loaded in a memory of a peripheral device of the computing device;
• instantiating, by the bootloader, a sandbox to isolate execution of the device driver from execution of the bootloader;
• receiving, at a wrapper of the sandbox, a request from the device driver to have the bootloader perform an action;
• in response to the request, issuing, by the wrapper, a system call to cause the bootloader to perform the action;
• and
• in response to determining that the isolated device driver has requested an inappropriate action, the sandbox terminating execution of the device driver.

A computing device, comprising:

• a peripheral device including a memory having firmware stored therein;
• a processor;
• and
• memory having program instructions stored therein that are executable by the processor to cause the computing device to perform operations including:
• initiating, by a bootloader, a boot sequence to load an operating system of the computing device;
• detecting, by the bootloader, the peripheral device during the boot sequence;
• in response to the detecting, implementing, by the bootloader, a sandbox that restricts execution of the firmware;
• receiving, at a wrapper of the sandbox, a request from the firmware to have the bootloader perform an operation;
• and
• in response to the request, issuing, by the wrapper, a system call to cause the bootloader to perform the operation.