Language Selection

English French German Italian Portuguese Spanish

Compartmentalized computing with CLIP OS

Filed under
OS
Gentoo

The design of CLIP OS 5 includes three elements: a bootloader, a core system, and the cages. The system uses secure boot with signed binaries. Only the x86 architecture was supported in the previous versions, and there are no other architectures in the plan for now. The core system is based on Hardened Gentoo. Finally, the cages provide user sessions, with applications and documents.

Processes running in separate cages cannot communicate directly. Instead, they must pass messages using special services on the core system; these services are unprivileged and confined on the cage system, but privileged on the core. These communication paths are shown in this architecture diagram from the documentation. Cages are also isolated from the core system itself — all interactions (system calls, for example) are checked and go through mediation services. The isolation between applications will be using containers, and the team plans to use the Flatpak format. The details of the CLIP OS 5 implementation are not available yet, as this feature is planned for the stable release.

A specific Linux security module (LSM) inspired from Linux-VServer will be used to add additional isolation between the cages, and between the cages and the core system. Linux-VServer is a virtual private server implementation designed for web hosting. It implements partitioning of a computer system in terms of CPU time, memory, the filesystem, and network addressing into security contexts. Starting and stopping a new virtual server corresponds to setting up and tearing down a security context.

Read more

More in Tux Machines

today's howtos and programming

KDE: Krita Interview, KDE Developer Documentation and KDE Craft Packager

  • Krita Interview with Anna Hannon
    I opted for trying Linux Mint, and tested Krita as my Photoshop replacement. Love at first sight! I currently run Manjaro KDE and it continues to be my only painting software (even on my Microsoft surface).
  • KDE Developer Documentation Update: Far from the Endgame
    It has been nearly three months since I embarked on an adventure in the land known as dev docs. And while the set period for that work is coming to a close, the truth is that the journey has really only just begun. Just like the pioneers of old, the first important step is to get to survey the land and map it for future adventurers. The KDE community’s developer documentation isn’t exactly new territory but, through the years, it has grown from a garden to a huge forest with only a brave few doing the work to keep things from getting out of hand. They could use a helping hand.
  • KDE Craft Packager on macOS
    In Craft, to create a package, we can use craft --package after the compiling and the installing of a library or an application with given blueprint name. On macOS, MacDMGPackager is the packager used by Craft. The MacDylibBundleris used in MacDMGPackager to handle the dependencies. In this article, I’ll give a brief introduction of the two classes and the improvement which I’ve done for my GSoC project.

10 Best Free Linux Docks

Docks are utility software designed to basically make launching applications and navigating between app windows as easy as possible alongside beautifying the entire process. They implement animations, app icon shadows, customization options, widgets, etc. in different ways but they all aspire to one goal – boost productivity. Read more

15 Best Free Linux Bioinformatics Tools

Bioinformatics has been defined in many different ways, but it is common ground to regard this discipline as the application of mathematics, computing and statistics to the analysis of biological information. The objective of bioinformatics is to enable the finding of new biological insights, and to create a broader, more critical view from which unifying principles in biology can be perceived. Bioinformatics is very important in the field of human genome research. It has become crucial for large-scale measurement technologies such as DNA sequencing, microarrays, and metabolomics. The field of bioinformatics has been aided significantly by Linux-based hardware and software. There are a number of Linux distributions which offer an integrated bioinformatics workstation. The popular distribution Bio-Linux packages hundreds of bioinformatics programs spanning a number of different fields. There’s a wide selection of Linux bioinformatics tools released under an open source license. This article identifies our favorite tools which are extremely useful for anyone interested in sequence analysis, molecular modelling, molecular dynamics, phylogenetic analysis and more. We hope this feature offers a useful resource for biologists. Read more