Language Selection

English French German Italian Portuguese Spanish

Compartmentalized computing with CLIP OS

Submitted by Roy Schestowitz on Thursday 8th of November 2018 07:22:34 PM Filed under
OS
Gentoo

The design of CLIP OS 5 includes three elements: a bootloader, a core system, and the cages. The system uses secure boot with signed binaries. Only the x86 architecture was supported in the previous versions, and there are no other architectures in the plan for now. The core system is based on Hardened Gentoo. Finally, the cages provide user sessions, with applications and documents.

Processes running in separate cages cannot communicate directly. Instead, they must pass messages using special services on the core system; these services are unprivileged and confined on the cage system, but privileged on the core. These communication paths are shown in this architecture diagram from the documentation. Cages are also isolated from the core system itself — all interactions (system calls, for example) are checked and go through mediation services. The isolation between applications will be using containers, and the team plans to use the Flatpak format. The details of the CLIP OS 5 implementation are not available yet, as this feature is planned for the stable release.

A specific Linux security module (LSM) inspired from Linux-VServer will be used to add additional isolation between the cages, and between the cages and the core system. Linux-VServer is a virtual private server implementation designed for web hosting. It implements partitioning of a computer system in terms of CPU time, memory, the filesystem, and network addressing into security contexts. Starting and stopping a new virtual server corresponds to setting up and tearing down a security context.

Read more

»

More in Tux Machines

Tails 3.11 and Tor Transparency (Financials)

The Year 2018 in Open Hardware and MIT's 3D Printer

  • The Year 2018 in Open Hardware
    2018 saw several open hardware projects reach fruition. Where the open hardware movement goes from here, remains to be seen. 2018 was not “The Year of Open Hardware,” any more than it was the fabled “Year of the Linux Desktop.” All the same, 2018 was a year in which open hardware projects started to move from fundraising and project development to product releases. Many of these open products were traditional hardware, but 2018 also saw the release of innovative tech in the form of new and useful gadgets. In the background, open hardware hangs on to traditional niches. These niches occur at the intersection of altruism, hobbyists, academia, and the market, to say nothing of crowdfunding and the relative affordability of 3D printing. A prime example of this intersection is the development of prosthetics. Much of the modern work in open hardware began almost a decade ago with the Yale OpenHand project. At the same time, sites like Hackaday.io offer kits and specifications for hobbyists, while the e-NABLE site has become a place for exchanging ideas for everyone from tinkerers to working professionals in the field. As a result, open hardware technology in the field of prosthetics has grown to rival traditional manufacturers in a handful of years. This niche is a natural one for open hardware not only because of the freely available resources, but for simple economics. Traditionally manufactured prosthetic hands begin at about $30,000, far beyond the budgets of many potential customers. By contrast, an open hardware-based company like the UK based Open Bionics can design a cosmetically-pleasing hand for $200, which is still a large sum in impoverished areas, but far more obtainable. A non-profit called Social Hardware estimates that a need for prosthetic hands in India alone numbers 26,000 and hopes to help meet the demand by offering a development kit on which enthusiasts can learn and later donate their results to those who need them.
  • This MIT Developed 3D Printer Is 10 Times Faster Than Modern 3D Printers
    3D printers have become more and more useful in the mass production of complex products that are cheaper and stronger. However, the only issue with 3D printing is its slow speed. These desktop 3D printers can print only one product at a time and only one thin layer at a making.
  • Accelerating 3-D printing
    Imagine a world in which objects could be fabricated in minutes and customized to the task at hand. An inventor with an idea for a new product could develop a prototype for testing while on a coffee break. A company could mass-produce parts and products, even complex ones, without being tied down to part-specific tooling and machines that can’t be moved. A surgeon could get a bespoke replacement knee for a patient without leaving the operating theater. And a repair person could identify a faulty part and fabricate a new one on site — no need to go to a warehouse to get something out of inventory.

FreeBSD 12.0, FreeNAS 11.2 and DNSSEC enabled in default unbound(8) configuration

Programming: Linux Direct Rendering Manger Subsystem, Python, QtCreator CMake, Rust and More

  • The Linux Direct Rendering Manger Subsystem Poised To Have A Second Maintainer
    For hopefully helping out with code reviews and getting code staged in a timely manner before being upstreamed to the mainline Linux kernel, Daniel Vetter of the Intel Open-Source Technology Center is set to become a co-maintainer.  Daniel Vetter who has been with Intel OTC for a number of years working on their Linux graphics driver has proposed becoming a DRM co-maintainer, "MAINTAINERS: Daniel for drm co-maintainer...lkml and Linus gained a CoC, and it's serious this time. Which means my [number one] reason for declining to officially step up as drm maintainer is gone, and I didn't find any new good excuse."
  • Discovering the pathlib module
    The Python Standard Library is like a gold mine, and the pathlib module is really a gem.
  • QtCreator CMake for Android plugin
    It’s about QtCreator CMake for Android! I know it’s a strange coincidence between this article and The Qt Company’s decision to ditch QBS and use CMake for Qt 6, but I swear I started to work on this project *before* they announced it ! This plugin enables painless experience when you want to create Android apps using Qt, CMake and QtCreator. It’s almost as easy as Android Qmake QtCreator plugin! The user will build, run & debug Qt on Android Apps as easy as it does with Qmake.
  • Testing Your Code with Python's pytest, Part II
  • Top Tips For Aspiring Web Developers
    As we’re a portal geared towards open-source development, we’re naturally going to bang the drum about the benefits of getting involved in open-source projects. There are so many fantastic open-source projects that are still going strong today – WordPress, Android and even Ubuntu/Linux to name but a few. Open source projects will give you direct hands-on experience, allowing you to build your own portfolio of work and network with other like-minded developers too.
  • Announcing Rust 1.31 and Rust 2018
    The Rust team is happy to announce a new version of Rust, 1.31.0, and "Rust 2018" as well. Rust is a programming language that empowers everyone to build reliable and efficient software.
  • A call for Rust 2019 Roadmap blog posts
    It's almost 2019! As such, the Rust team needs to create a roadmap for Rust's development next year.
  • Processing CloudEvents with Eclipse Vert.x
    Our connected world is full of events that are triggered or received by different software services. One of the big issues is that event publishers tend to describe events differently and in ways that are mostly incompatible with each other. To address this, the Serverless Working Group from the Cloud Native Computing Foundation (CNCF) recently announced version 0.2 of the CloudEvents specification. The specification aims to describe event data in a common, standardized way. To some degree, a CloudEvent is an abstract envelope with some specified attributes that describe a concrete event and its data.

More on Tux Machines: About ● Gallery ● Forum ● Blogs ● Search ● News ● RSS Feed

Part of Bytes Media ● Sister sites below.

TechBytes Techrights button

Powered by Drupal, an open source content management system

Content available under CC-BY-SA CC

© by original authors

Powered by CentOS 6.5 (GNU/Linux), Varnish, and Drupal 6