15 ms·
Nebulet: A microkernel that runs WebAssembly in Ring 0
- exabrial 8y agoOk I don't understand the reasoning behind why this is safe... The explanation is pretty sparse.
- als0 8y agoAbout as safe as other managed languages...the security here is dependent on how well implemented the sandbox is.
- jerf 8y agoI don't see how to square "makes essentially arbitrary syscalls so we can run faster than Linux code" and "is safe". WebAssembly is not Platonically safe; it's safe for specific reasons. If you bind syscalls into it, or more generally, bind anything that allows you to do what syscalls do in an OS, you're going to be poking holes in its safety at a distressing pace, because you're taking some of the reasons WebAssembly is safe, and throwing them away. It may be memory safe, but honestly, memory-safety is no great trick anymore... pretty much everything except the languages currently used to implement kernels is memory safe. Memory safe is still not "generally safe".
- simen 8y agoIt all depends on how safe the OS software sandbox is. Which is something that recent HW vulnerabilities really has emphasized even if you're not running in ring0. And it's not like this is a new idea: as mentioned, Microsoft already built a research OS on this idea. Personally, I say more power to this high schooler. It's just a research project, and it'll be interesting to see where it goes. Nobody is suggesting you replace Linux/OSX/Windows with this thing anytime soon.
- ratmice 8y agoEven before MS, there was UW/spin os, on the language modula-3, in the mid-90s http://www-spin.cs.washington.edu/ http://www-spin.cs.washington.edu/
- jchw 8y agoThe language is memory safe, so it is theoretically limited to the surface area that the non-memory-safe OS libraries allow. Of course, that is assuming there are no exploits in the WebAssembly compiler, and no exploits in the OS libraries. Access to syscalls would not be unusual in any case. This is the normal attack surface for an OS. The new attack surface is the WebAssembly compiler and checker. To be honest though, given the processor vulnerabilities that have come about, I don't know if I really feel so bad about software protections like this anymore. Nothing is a panacea, even magical processor protection rings.
- gnode 8y agoI think in light of recent processor bugs, there's also an argument that software protection is easier to patch than hardware protection.
- bryanlarsen 8y agodiscussion on the similar project Cervus from earlier today: https://news.ycombinator.com/item?id=17184410 https://news.ycombinator.com/item?id=17184410
- Sir_Cmpwn 8y agoObligitory: https://www.destroyallsoftware.com/talks/the-birth-and-death-of-javascript https://www.destroyallsoftware.com/talks/the-birth-and-death...
- deleted 8y ago[deleted]
- deleted 8y ago[deleted]
- sp332 8y agoIt's a really funny talk, but this is nothing we haven't seen before with Java, Python, .Net... heck one of the most popular unikernel implementations is in OCaml! We'll survive having more languages in/as kernels.
- carry_bit 8y agoIf it's actually prophecy coming true, people might want to leave SF before it becomes part of the exclusion zone.
- microcolonel 8y agoIt's already happened, it's just that the SF/MV overmind migrated to another host and has resumed normal operation.
- willsinclair 8y ago> Normally, this would be super dangerous, but WebAssembly is designed to run safely on remote computers, so it can be securely sandboxed without losing performance. This seems a like a pretty strong claim. I hope that it's true, but I'm not going to be running WASM modules in ring 0 any time soon.
- Communitivity 8y agoAgreed. I highly advise against this. What I heard when I read this headline was 'WebAssembly has no vulnerabilitities so we can run remote WebAssembly code in ring 0 without worry'. Almost everything has some kind of vulnerability, it is simply a matter of the time necessary to find it. The more analyzed and tested a software is, the more time it will take to find the next vulnerability (Barnhill's Law).
- gnode 8y agoIt's relative. ring 3 / the hardware isn't guaranteed to be free of vulnerabilities either. What probably has the most bearing on the securability of a platform is its simplicity, which is on WebAssembly's side.
- baybal2 8y agoWASM is a stack machine, which does not add to security. You sense that no real VM specialist, nor one in field of security put hand to its design. When I first read the specs, it screamed to me "VM design 101." It feels to be someones master thesis, more than a piece of production software. Just as the original Netscape Javascript 1.0 was. It will have its fair share of "typeof null" style bugs to come.
- bennofs 8y agoWhy is a stack machine bad for security? The JVM also had sandboxed execution as a goal and also uses a stack machine. But perhaps the stack machine was choosen because it tends to produce smaller binaries (which is important for things you send over the net) and not for security reasons?
- kodablah 8y agoMore context: http://lsneff.me/nebulet-booting-up/ http://lsneff.me/nebulet-booting-up/ http://lsneff.me/why-nebulet/ http://lsneff.me/why-nebulet/
- kowdermeister 8y ago"Nebulet is just a way to try new ideas in operating system design. It’s a playground for interesting and exotic techniques that could improve performance, usability, and security." That's it. I hope he gets the support he needs.
- empath75 8y ago> I hope he gets the support he needs. That's what you say when someone checks into rehab, not releases a software project :)
- xena 8y agoIs there a difference?
- steveklabnik 8y agoNebulet is a Google Summer of Code project through Mozilla, in my understanding.
- matachuan 8y agoThis is an interesting idea by putting some userspace stuff back into kernel. But I wonder how much overhead you can save as the supporting argument is just one sentence.
- vectorEQ 8y agocontext switches / syscalls cost a lot of cycles to save and reload cpu context. you basically need to push all stuff to memory related to context, registers, flags, stack pointers et.c etc., then load the ones for kernel space, perform some call, and switch back. This means a lot of overhead is saved, especially for small functions. https://wiki.osdev.org/Context_Switching https://wiki.osdev.org/Context_Switching
- matachuan 8y agolol I'm well informed on this topic but thanks anyway. Maybe I didn't make myself clear in my previous post. I was questioning the motivation -- Is there any existing profiling work that shows a significant amount of time has been spent on context switches in this particular workloads and how much you can save by adopting this approach.
- candiodari 8y agoUnikernels are generally considered especially advantageous in network servers.
- eptcyka 8y agoWell, do you not recall the massive amounts of moaning that took place because now everyone's I/O bound stuff (most webservers/databases) works far slower than it used to when spectre/meltdown patches had been applied? If we could get rid of the cache flush that occurs when a userspace process syscalls, there'd be a lot less heat produced at your local data center.
- matachuan 8y ago
- pcwalton 8y agoLinux already allows untrusted user code to be run in a ring 0 VM, via BPF/eBPF. Honestly, given the choice between Web Assembly and eBPF to run in kernel mode, I'd go with Web Assembly. The fewer secure VMs that have to be audited, the better.
- monocasa 8y agoTo be fair, BPF/eBPF is far more designed for simple and obviously correct verification. For eBPF, it's 10 register, two address, but load store, so that on CISC and RISC platforms there's generally a 1 to 1 between eBPF asm and JITed ASM. So the in kernel JIT doesn't even need a register allocator. The code flow graph is constrained to be a DAG so you can solve the halting problem on programs. etc. You're looking at at least a couple of orders of magnitude more work to get to the same level of correctness for a WebAssembly runtime.
- titzer 8y agoThere has been a WebAssembly interpreter implemented in Isabelle [1] and it's been proved correct. Not fast, but still pretty cool. [1] https://www.isa-afp.org/entries/WebAssembly.html https://www.isa-afp.org/entries/WebAssembly.html
- titzer 8y agoThat said, I still wouldn't put it in ring 0, as per my comment on the other thread: https://news.ycombinator.com/item?id=17186842 https://news.ycombinator.com/item?id=17186842
- monocasa 8y ago> Not fast That's the kicker. BPF is simpler, _and_ in spitting distance of native code perf. And if you're doing something crazy like injecting user code into interrupts, you care about perf. That being said, you're totally right that it's possible to get parity, just orders of magnitudes more work.
- pcwalton 8y ago
- vectorEQ 8y agointeresting project. it's not safe, but definatly i like this kind of application of system software. It might be interesting to try and run the webassembly in a VM ring 0 where the ring -1 can do some security routines and checks on it, but that might be beyond the scope and intent of this project.
- IncRnd 8y ago> Normally, this would be super dangerous, but WebAssembly is designed to run safely on remote computers, so it can be securely sandboxed without losing performance. This throws away the very important security property of defense in depth. A system design should include interlocking levels of security, so even if there is a vulnerability in one place, extra work may be required to exploit it.
- pcwalton 8y agoIt's no worse than what Linux already allows via eBPF.
- IncRnd 8y agoSo? Removing hw ring protections for all programs is not the answer. You are actually making my point.
- pcwalton 8y agoIs your position that Linux should remove eBPF?
- IncRnd 8y agoThat's not germane to this discussion. My position is that this project throws away defense in depth. Is your point that because eBPF exists in a different OS that there is no security impact to using Nebulet?
- pcwalton 8y agoI think that having a user-accessible VM in the kernel is a useful thing that a lot of OS's eventually need for other reasons (e.g. packet filtering, syscall sandboxing). We might as well design for it properly up front.
- 8y ago
- mhandley 8y agoSo in light of Spectre, the Chrome developers don't believe it's safe to have any sensitive data in the same memory space as V8, but WebAssembly is safe in ring 0? What am I missing here? https://chromium.googlesource.com/chromium/src/+/master/docs/security/side-channel-threat-model.md https://chromium.googlesource.com/chromium/src/+/master/docs...
- OnlyRepliesToBS 8y agoMinus Chrome.
- netsharc 8y ago"Normally, this would be super dangerous, but WebAssembly is designed to run safely on remote computers, so it can be securely sandboxed without losing performance." I'm staring at this sentence hoping the author is being supremely sarcastic...
- AgentME 8y agoI think they're saying that WebAssembly code doesn't lose any performance when you sandbox it, not that WebAssembly has equivalent performance to native code.
- Matheus28 8y agoNote: I haven’t read the source code so I’m not sure how it’s actually implemented, this is off my personal knowledge of WebAssembly and Spectre. WebAssembly isn’t assembly. It can only refer to memory offsets within its allocated block (so it always does *(baseAddr + offset)), so to generate assembly for it, you already need to add checks. One way to prevent some spectre-like attacks is to mask the offset after those checks. Another way is to use virtual memory to keep program spaces very far apart and only use int32 displacements in memory loads (since they’re always relative to the base memory address).
- titzer 8y ago> One way to prevent some spectre-like attacks is to mask the offset after those checks. This is the mitigation we implemented in V8, but it doesn't remove all possible side channels.
- xenadu02 8y agoHe mentions Singularity as inspiration which is exactly what came to my mind. This isn’t an unproven space. Singularity proved you can use a single global address space (given 64-bit) and software to isolate processes - something MS Research called Software Isolated Processes. This requires a verifiable bytecode/VM system so the kernel can verify the instruction stream at load time. In a way, WebAssembly is even easier to verify than C#. It’s obviously a research toy but that isn’t a bad thing.
- kllrnohj 8y agoThat was before spectre happened. Software isolated processes are now basically impossible to do. All the CPU microcode updates & workarounds are purely about fixing isolation between processes & rings that the CPU is aware of.
- mickronome 8y agoDoes that really follow? That purely software based solutions are doomed because hardware based solutions failed? Wasn't most fixes done at least partially in software?
- kllrnohj 8y agoI think you misunderstood. The hardware-based solutions are being fixed with various approaches whereas the software-based solutions nobody has any clue how to fix. So much so that Chrome is giving up on software-isolation entirely and is rolling out even more process-based sandboxing https://www.chromium.org/Home/chromium-security/site-isolation https://www.chromium.org/Home/chromium-security/site-isolati...
- andreiw 8y agoDepends on how you define hardware and software. There are global workarounds that amount to crippling CPU behavior, to provide guarantees for code not written to be spectre safe. I guess that’s what you mean by “hardware”. But “software” approaches are localized mitigations to code written to avoid spectre attacks - and these localized mitigations use arch specific sequences to do so.
- childintime 8y agoWell, congratulations are in order, if this is the first step towards throwing out most of the OS. Face it. Linux had its time, its conception of the world reflect a developers wet dream from the mainframe era, with many users, few resources, and the soon to be extinct dictator, err, universally hated system administrator. Who needs elaborate permissions when you're the only user on the system? Which user still shares data without sending it, manipulating permissions? Who likes managing installs and incompatible dependencies? Hell, just copy the data, that's what we all do. The file-system dedups it anyways if necessary. The list of unused and unwanted features goes on, but developers just keep reincarnating this same old fantasy of an anachronistic OS. It seems to me nobody but Linus can make them see again.. Linus, there's so much pain. What's the use case these days? Do you see Linux going over its own horizon, how? I suspect your answer involves a server OS. PS, this idea of course also reminds of Microsoft's Singularity OS.
- umanwizard 8y agoVirtually all production servers in the world today are running GNU/Linux. The substantial majority of smartphones run a Linux kernel. I wouldn't say Linux has "had its time". You may be right that the traditional permissions model is outdated, but it represents only a very small part of what Linux does, and indeed it seems totally unrelated to this project, so I'm not sure what point you're making. To use the Android example again, it's proof that you can layer a very different permissions model (single-human-user app sandboxing) on top of the Linux kernel.
- filleduchaos 8y agoAndroid uses the Unix permission model heavily - sandboxing is achieved by creating a new user per app, and filesystem, network, etc permissions are managed via user and group IDs just like with Unix. So how is it "very different" (in implementation, not surface appearance)?
- umanwizard 8y agoSurface appearance was my point -- it's possible to create a model that's very different from the user's perspective without changing the underlying model of the kernel.
- kibwen 8y agoThe author has previously done AMAs on /r/rust: https://www.reddit.com/r/rust/comments/8j7y1f/i_am_lachlansneff_creator_of_nebulet_a_rust/ https://www.reddit.com/r/rust/comments/8j7y1f/i_am_lachlansn... and https://www.reddit.com/r/rust/comments/8bzex4/a_microkernel_that_implements_a_webassembly/ https://www.reddit.com/r/rust/comments/8bzex4/a_microkernel_... And yes, for those comparing this to The Birth And Death Of JavaScript: "After watching it for the first time, I realized that the joke idea that Gary proposed could actually work, and work well! I'd say that that talk is probably why I started writing Nebulet."
- ttflee 8y agoIt should be renamed METAL sometime in the future and we should start implementing an open source shim named Cacao, before the nuclear war break out.
- lachlan-sneff 8y agoAn earlier version of nebulet was named "Metal OS".
- 2bitencryption 8y agojust when i was beginning to feel adequate, i discover this is all done by a highschooler :( congrats to that kid, he's got a damn good head on his shoulders.
- chocolatkey 8y agoNow you made me look at his GitHub... You are not alone, but yes congrats
- pgeorgi 8y agohighschoolers have one wonderful resource in abundance (compared to the working population) and that's time.
- lachlan-sneff 8y agoYeah, no, we don't. I just find time for the things I love.
- danaliv 8y agoTrust me - compared to working adults, you do. :)
- jzoch 8y agoAs someone who was in high school just a few years ago and am now working I would argue that is definitely not true. High school can quite easily take a lot more time than work, especially if you are an honors student or do any extra-curricular activities. I would wake up at 6 am, be at school at 6:45am, and leave school at 5pm most days of the week due to sports and class. Then I would have 2-5 hours of homework to do. Now, working for a large company is 40-50 hours a week, 9am-6pm with little work after hours.
- JacobGoodson 8y agoDepends on the job, some of us do a lot more than 40. Getting married and having children will make you reassess your statements. Heck, just getting married will. Of course, I am assuming that you are single.
- moonbug 8y agoJust reading that title makes me feel a little fit sick
- alexandernst 8y agoBecause what could possibly go wrong?
- phkahler 8y agoWhat's safer, running untrusted code at ring 0, or running it at a lower privilege level? The answer should be obvious to anyone that's not dreaming of some ideal world. Ideals are great to strive for BTW, just don't lie to yourself about already having gotten there.
- roblabla 8y agoThe point isn't to be safe, the point is to be both safe and fast.
- phkahler 8y agoLower privilege levels don't really convey performance benefits. I suppose syscall overhead may impact some applications, but one should not be running untrusted code where the performance bottleneck is accessing the system.
- haglin 8y agoJava Applets were supposed to be safe too.
- mrybczyn 8y agoI love it. God speed. The idea of a multi-user time-sharing virtual memory operating system is seriously outdated. Today, the server OS could be based on a one user, multi computer abstraction, with multiple gigs of memory, solid state storage, and reliable gigE+ network as assumed essentials. Entire sub-systems of the current linux kernel can be omitted. Most of the VFS layer, with so many optimizations for spinning rust. Right out. Paging, swapping, shared objects, address randomization and PIC. Right out. User access controls, file access controls, network access controls / firewalls. Right out. Of the 50,000 device drivers in the linux kernel, probably 50 deserve to be supported. For a workstation with graphics / GPU and console support, and every pluggable external device support, maybe some sort of legacy emulation layer would work. Basically run a linux VM for backwards compatibility with those 50,000 devices. Would be less work than implementing those drivers... Remember, Linus was once a 19 year old with a dream, and a small repo of prototype kernel demo code, 25 years ago.
- nerdponx 8y agoAs part of the lightly educated masses, this sounds good to me. Can anyone more knowledgeable than me comment on the feasibility of something like this?
- kartan 8y agoJavaScript was running in the browser until Ryan Dahl decided to create Node.js. Nowadays it is a big platform, and it can run also WebAssembly. This is just another step in that direction where is the OS the one running that code. Does it have problems? Yes. Adding more complexity to the kernel will open new attack vectors for breaking its security. But that is true for any added layer, even in the hardware which complexity has brought Meltdown and Spectre. Running JavaScript in your kernel is a lot riskier than running it in your app. The good news is that WebAssembly is created with sandboxing in mind. I hope they have learned some lessons (https://en.wikipedia.org/wiki/Java_security https://en.wikipedia.org/wiki/Java_security).
- FooHentai 8y agoTo the extent the OP took it, as a universal way that 'servers' could go, not very feasible. Partly because we already HAVE what's being described, in the form of hypervisors. We then layer within it all that other stuff that's chopped away to bring us back to a system that has a bunch of stuff we want, but most importantly that supports a wide range of applications we want to deploy. The big problem with stripping back to the absolute bare essentials is that you optimize towards a local maxim, and severely limit your flexibility. This is certainly the way you want to go if you have deep pockets coupled with a need for bare-bones speed that can't be sharded in an effective manner. But that's not the majority of workloads.
- ixtli 8y agoI love this because im closer to being right about my claim that eventually a restricted javascript will replace arch specific assemblies >:D
- kartan 8y agoThis is what the Java Virtual Machine could have been but never was. Most applications are so lightweight for today's computer capabilities that running them over a virtualization layer is not a problem at all. As a developer I want my applications to run everywhere without having to take into account different OSs, architectures, etc. You still will have native applications for a lot of different situations where performance is more critical and paying the higher cost of creating, testing and distributing for different OSs. That is a skill that should never die, like creating the hardware itself. HTML5 is a good attempt to this, but it has problems with not-well-defined behaviours and the fact that not all applications, e.g. games, fit the hypertext approach.
- umanwizard 8y agoWhat problem exactly do you have with Java?
- kartan 8y agoJava virtual machine could have had better integration into OSs and browsers, but it's licensing model made it impossible. I worked with Applets on the browser and had a lot of potential, but probably it was too soon for them as computers where slower and Java was not so will optimized back then. WebAssembly doesn't has this history and it can be used in ways that Java has been discarded for historical reasons.
- bigbluedots 8y agoThis does not sound like a good thing for anyone to actually use in production ...