4 ms·

There's a tendency to assume that because newer languages are safer than C that they are "safe". I suspect people would be unlikely to think about the problem i

There's a tendency to assume that because newer languages are safer than C that they are "safe". I suspect people would be unlikely to think about the problem in the same way for, say, Go or Rust, even though there are still security gotchas that can happen when dealing with system calls from those languages. But, then again, a lot of the kinds of security bugs tame() is addressing really are already unlikely in Go or Rust. But, now that I think about it, I would like to see examples of priv-sep in Go or Rust. It's a challenging problem in C, and one that I never implemented (I was moving away from working on any C projects within a couple of years of priv-sep being introduced into OpenSSH), and one of the things that is neat about tame() is that is seems to abstract some of those difficult aspects. So, seeing best practices for priv-sep in a modern language would be really cool...I wouldn't even know where to start to figure it out, since I'm so new to both Rust and Go.

technofiend 11y ago
I keep wondering if it's time for a Gopen BSD or a Rust in BSDeace or some equally terrible name that means re-writing the OS except for the fiddly assembler bits in a safer language. Where are Vernor Vinge's Focused programmers when you really need to outsource something?
- vezzy-fnord 11y ago
  lsub is currently working on a Plan 9-ish OS in Go called Clive, though still as a research system: http://lsub.org/ls/clive.html http://lsub.org/ls/clive.html
  - technofiend 11y ago
    Oh man Plan 9 broke my heart once already when they didn't become the Next Big Thing. I was digging their take on namespaces after seeing something similar for filesystems on Apollo's UNIX. I would love to "break glass" (I.e. temporarily gain privileged access) to a remote system's namepace and dtrace/systemtap running processeses without ever leaving my desktop.
- SwellJoe 11y ago
  There's Redox, which was just discussed on HN yesterday: https://news.ycombinator.com/item?id=10295187 https://news.ycombinator.com/item?id=10295187 There are also a couple of projects re-implementing the standard UNIX utilities in Rust and Go. I suspect that, like Linux couldn't have exploded in popularity without an existing and excellent suite of utility programs, it's unlikely a new OS could take off without the same existing for it. Though, implementing a UNIX-like/POSIX-compatible kernel might be a reasonable starting point. So far, however, the folks working on operating systems in Rust and Go are wanting to implement actually new operating systems, not merely reimplement UNIX in those languages. Which is to say, maybe an impossible goal, I dunno. No other kind of "make a better OS" project has actually succeeded without massive financial backing, and there have been many.
JoshTriplett 11y ago
> I would like to see examples of priv-sep in Go or Rust. Both seccomp and separation of privileged processes seem fairly straightforward under Rust. (The former would require some knowledge of the syscalls Rust wants to use internally; the latter just involves fork and setuid/setgid.)
- pcwalton 11y ago
  > Both seccomp and separation of privileged processes seem fairly straightforward under Rust. I have a crate for this, the use of which should be landed in Servo any day now: https://github.com/pcwalton/gaol https://github.com/pcwalton/gaol

technofiend 11y ago

I keep wondering if it's time for a Gopen BSD or a Rust in BSDeace or some equally terrible name that means re-writing the OS except for the fiddly assembler bits in a safer language. Where are Vernor Vinge's Focused programmers when you really need to outsource something?

vezzy-fnord 11y ago
lsub is currently working on a Plan 9-ish OS in Go called Clive, though still as a research system: http://lsub.org/ls/clive.html http://lsub.org/ls/clive.html
- technofiend 11y ago
  Oh man Plan 9 broke my heart once already when they didn't become the Next Big Thing. I was digging their take on namespaces after seeing something similar for filesystems on Apollo's UNIX. I would love to "break glass" (I.e. temporarily gain privileged access) to a remote system's namepace and dtrace/systemtap running processeses without ever leaving my desktop.
SwellJoe 11y ago
There's Redox, which was just discussed on HN yesterday: https://news.ycombinator.com/item?id=10295187 https://news.ycombinator.com/item?id=10295187 There are also a couple of projects re-implementing the standard UNIX utilities in Rust and Go. I suspect that, like Linux couldn't have exploded in popularity without an existing and excellent suite of utility programs, it's unlikely a new OS could take off without the same existing for it. Though, implementing a UNIX-like/POSIX-compatible kernel might be a reasonable starting point. So far, however, the folks working on operating systems in Rust and Go are wanting to implement actually new operating systems, not merely reimplement UNIX in those languages. Which is to say, maybe an impossible goal, I dunno. No other kind of "make a better OS" project has actually succeeded without massive financial backing, and there have been many.

JoshTriplett 11y ago

> I would like to see examples of priv-sep in Go or Rust. Both seccomp and separation of privileged processes seem fairly straightforward under Rust. (The former would require some knowledge of the syscalls Rust wants to use internally; the latter just involves fork and setuid/setgid.)

pcwalton 11y ago
> Both seccomp and separation of privileged processes seem fairly straightforward under Rust. I have a crate for this, the use of which should be landed in Servo any day now: https://github.com/pcwalton/gaol https://github.com/pcwalton/gaol