Language Selection

English French German Italian Portuguese Spanish

Compartmentalized computing with CLIP OS

Filed under
OS
Gentoo

The design of CLIP OS 5 includes three elements: a bootloader, a core system, and the cages. The system uses secure boot with signed binaries. Only the x86 architecture was supported in the previous versions, and there are no other architectures in the plan for now. The core system is based on Hardened Gentoo. Finally, the cages provide user sessions, with applications and documents.

Processes running in separate cages cannot communicate directly. Instead, they must pass messages using special services on the core system; these services are unprivileged and confined on the cage system, but privileged on the core. These communication paths are shown in this architecture diagram from the documentation. Cages are also isolated from the core system itself — all interactions (system calls, for example) are checked and go through mediation services. The isolation between applications will be using containers, and the team plans to use the Flatpak format. The details of the CLIP OS 5 implementation are not available yet, as this feature is planned for the stable release.

A specific Linux security module (LSM) inspired from Linux-VServer will be used to add additional isolation between the cages, and between the cages and the core system. Linux-VServer is a virtual private server implementation designed for web hosting. It implements partitioning of a computer system in terms of CPU time, memory, the filesystem, and network addressing into security contexts. Starting and stopping a new virtual server corresponds to setting up and tearing down a security context.

Read more

More in Tux Machines

Android Leftovers

Samsung 970 EVO Plus 500GB NVMe Linux SSD Benchmarks

Announced at the end of January was the Samsung 970 EVO Plus as the first consumer-grade solid-state drive with 96-layer 3D NAND memory. The Samsung 970 EVO NVMe SSDs are now shipping and in this review are the first Linux benchmarks of these new SSDs in the form of the Samsung 970 EVO Plus 500GB MZ-V7S500B/AM compared to several other SSDs on Linux. The Samsung 970 EVO Plus uses the same Phoenix controller as in their existing SSDs but the big upgrade with the EVO Plus is the shift to the 96-layer 3D NAND memory. Available now through Internet retailers are the 250GB / 500GB / 1TB versions of the 970 EVO Plus at a new low of just $130 USD for the 500GB model or $250 USD for the 1TB version. A 2GB model is expected to ship this spring. Read more

elementary 5 "Juno"

In the spring of 2014 (nearly five years ago), I was preparing a regular presentation I give most years—where I look at the bad side (and the good side) of the greater Linux world. As I had done in years prior, I was preparing a graph showing the market share of various Linux distributions changing over time. But, this year, something was different. In the span of less than two years, a tiny little Linux distro came out of nowhere to become one of the most watched and talked about systems available. In the blink of an eye, it went from nothing to passing several grand-daddies of Linux flavors that had been around for decades. This was elementary. Needless to say, it caught my attention. Read more

Audiophile Linux Promises Aural Nirvana

Linux isn’t just for developers. I know that might come as a surprise for you, but the types of users that work with the open source platform are as varied as the available distributions. Take yours truly for example. Although I once studied programming, I am not a developer. The creating I do with Linux is with words, sounds, and visuals. I write books, I record audio, and a create digital images and video. And even though I don’t choose to work with distributions geared toward those specific tasks, they do exist. I also listen to a lot of music. I tend to listen to most of my music via vinyl. But sometimes I want to listen to music not available in my format of choice. That’s when I turn to digital music. Read more