3 ms·

I've seen people run a Linux firewall in runlevel 0 (this is 100% possible if you disable the shutdown script) where the entire user space was disabled and only

by SEJeff 11y ago

I've seen people run a Linux firewall in runlevel 0 (this is 100% possible if you disable the shutdown script) where the entire user space was disabled and only the netfilter stuff running in memory was active. This MASSIVELY limits the attack vectors to only the kernel itself and virtually nothing in user space while giving you a full Linux feature set, something I'm guessing Qubes doesn't yet do. I learned about this technique in the late 90s where a guy had 2 firewalls in active / failover mode using I believe LVS (also in kernel) with the sentry firewall cd (http://sentry.sourceforge.net http://sentry.sourceforge.net). There was out of band VPN into the network which allowed serial access to reboot them but once the ACLs were burned onto the CD, it was as immutable as it gets with no serious way to harm anything. Besides it being slightly harder to manage, I can't believe no one else has tried it and written about it. Sorry for getting side tracked, this looks absolutely fascinating and is another great use case for Qubes. The world of unikernels and containers / lightweight vms is clearly converging for immutable infra.

justincormack 11y ago
runlevel 0 is not really a thing from the kernel point of view, it is a construct if init. You can do the same by just having nothing in userspace other than the commands for config.
EvanPlaice 11y ago
I've been recently looking into Javascript based Unikernels. I have found 2 that look very promising. NodeOS: Takes the linux kernel and strips it to its bare minimum then adds Node/V8 running in kernel space for application support. No C applications, no POSIX utilities. POSIX equivalents (written in JS) are provided for only the most necessary tools. To build a server, you develop it as normal. Then, the build step packages your app with the kernel to be run as a standalone VM image. The OS is essentially immutable and since it contains no 'general purpose' utilities, the attack surface is limited to your application. For example, if you need a load balancer. You could import a Node load balancer implementation as a dependency, add a custom config, and generate the VM image for deployment. The image itself only requires a few MBs in space and can be booted up in seconds so versioning/deployment becomes trivial. Runtime.js: Takes things even further. Instead of using a thin linux kernel, the whole OS is implemented in JS. They're still building out the basic low-level infrastructure (ex networking protocols, filesystem adapters, etc). Regardless, it's fascinating to see somebody building an OS from scratch in a language that generally isn't known for system-level development. The performance improvements to be gained from eliminating all of the OS-level protections negate the performance disadvantages of using a higher level language. Eliminating all of the complexity that comes with monolithic, general purpose operating systems dramatically reduces the attack surface. That's just Node.js. There are plenty of Unikernels being developed for other languages. Since the cloud operates on virtual machine infrastructures, with mostly single-purpose applications, it makes sense to build single-purpose operating systems that can be deployed to the cloud.

by SEJeff 11y ago

justincormack 11y ago

runlevel 0 is not really a thing from the kernel point of view, it is a construct if init. You can do the same by just having nothing in userspace other than the commands for config.

EvanPlaice 11y ago

I've been recently looking into Javascript based Unikernels. I have found 2 that look very promising. NodeOS: Takes the linux kernel and strips it to its bare minimum then adds Node/V8 running in kernel space for application support. No C applications, no POSIX utilities. POSIX equivalents (written in JS) are provided for only the most necessary tools. To build a server, you develop it as normal. Then, the build step packages your app with the kernel to be run as a standalone VM image. The OS is essentially immutable and since it contains no 'general purpose' utilities, the attack surface is limited to your application. For example, if you need a load balancer. You could import a Node load balancer implementation as a dependency, add a custom config, and generate the VM image for deployment. The image itself only requires a few MBs in space and can be booted up in seconds so versioning/deployment becomes trivial. Runtime.js: Takes things even further. Instead of using a thin linux kernel, the whole OS is implemented in JS. They're still building out the basic low-level infrastructure (ex networking protocols, filesystem adapters, etc). Regardless, it's fascinating to see somebody building an OS from scratch in a language that generally isn't known for system-level development. The performance improvements to be gained from eliminating all of the OS-level protections negate the performance disadvantages of using a higher level language. Eliminating all of the complexity that comes with monolithic, general purpose operating systems dramatically reduces the attack surface. That's just Node.js. There are plenty of Unikernels being developed for other languages. Since the cloud operates on virtual machine infrastructures, with mostly single-purpose applications, it makes sense to build single-purpose operating systems that can be deployed to the cloud.