Language Selection

English French German Italian Portuguese Spanish

Compartmentalized computing with CLIP OS

Filed under
OS
Gentoo

The design of CLIP OS 5 includes three elements: a bootloader, a core system, and the cages. The system uses secure boot with signed binaries. Only the x86 architecture was supported in the previous versions, and there are no other architectures in the plan for now. The core system is based on Hardened Gentoo. Finally, the cages provide user sessions, with applications and documents.

Processes running in separate cages cannot communicate directly. Instead, they must pass messages using special services on the core system; these services are unprivileged and confined on the cage system, but privileged on the core. These communication paths are shown in this architecture diagram from the documentation. Cages are also isolated from the core system itself — all interactions (system calls, for example) are checked and go through mediation services. The isolation between applications will be using containers, and the team plans to use the Flatpak format. The details of the CLIP OS 5 implementation are not available yet, as this feature is planned for the stable release.

A specific Linux security module (LSM) inspired from Linux-VServer will be used to add additional isolation between the cages, and between the cages and the core system. Linux-VServer is a virtual private server implementation designed for web hosting. It implements partitioning of a computer system in terms of CPU time, memory, the filesystem, and network addressing into security contexts. Starting and stopping a new virtual server corresponds to setting up and tearing down a security context.

Read more

More in Tux Machines

Type Title Author Replies Last Postsort icon
Story Programming: Emacs Org, ISO C++, PyCharm and Recursive Programming Roy Schestowitz 15/02/2019 - 7:09pm
Story Graphics: Mesa/Virgl3D, Nouveaum and Gallium3D Roy Schestowitz 15/02/2019 - 7:06pm
Story Linux 5.1 Improvements Roy Schestowitz 15/02/2019 - 6:54pm
Story Android Leftovers Rianne Schestowitz 15/02/2019 - 6:40pm
Story Samsung 970 EVO Plus 500GB NVMe Linux SSD Benchmarks Rianne Schestowitz 15/02/2019 - 6:26pm
Story elementary 5 "Juno" Rianne Schestowitz 15/02/2019 - 6:21pm
Story Audiophile Linux Promises Aural Nirvana Rianne Schestowitz 15/02/2019 - 6:17pm
Story Ubuntu 18.04.2 LTS Released with Linux Kernel 4.18 from Ubuntu 18.10, More Rianne Schestowitz 2 15/02/2019 - 6:16pm
Story First Look: Tuxedo InfinityCube Linux Desktop PC With Intel Core-i7 8700 Rianne Schestowitz 15/02/2019 - 6:14pm
Story Redcore Linux Gives Gentoo a Nice Facelift Rianne Schestowitz 15/02/2019 - 6:12pm