Using a call gate to prevent secure sandbox leakage

A computer storage device encoded with a computer program, the program comprising instructions that when executed by data processing apparatus cause the data processing apparatus to perform operations comprising:

• receiving a request from an application to enable a secure sandbox;
• responsive to receiving the request, adding a call gate descriptor for a call gate to a segment descriptor table for the application, the call gate descriptor a first privilege level of the application and a second privilege level requested by the call gate, the first privilege level associated with the call gate, the second privilege level being relatively higher than the first privilege level;
• providing a call gate selector for the call gate descriptor to the application in response to the request;
• receiving a far call from the application, the far call having a segment selector that references the call gate descriptor;
• and
• in response to the far call:
• transitioning into the second privilege level;
• switching into the call gate target code based on the segment selector;
• executing the call gate target code to enable a selective redirection;
• and
• returning control to the application upon the enabling of the selective redirection.

A system comprising:

• a processor;
• and
• a computer readable storage device coupled to the processor and having stored therein an application, a device driver, and an operating system kernel,
• the computer readable storage device further having instructions that, responsive to execution by the processor, cause the processor to:
• receive a request from an application to enable a secure sandbox;
• responsive to the request being received, add a call gate descriptor for a call gate to a segment descriptor table for the application, the call gate descriptor configured to specify a first privilege level of the application and a second privilege level requested by the call gate, the second privilege level being relatively higher than the first privilege level;
• provide a call gate selector for the call gate descriptor to the application in response to the request;
• receive a far call from the application, the far call having a segment selector that comprises the call gate descriptor;
• and
• responsive to the far call being received:
• transition into the second privilege level;
• switch into the call gate target code based on the segment selector;
• execute the call gate target code to enable a selective redirection;
• and
• return control to the application upon the enabling of the selective redirection.