4 ms·

Is it actually possible to implement security in this OS without a complete redesign and basically redoing what all other existing OS have already done? I am a

Is it actually possible to implement security in this OS without a complete redesign and basically redoing what all other existing OS have already done? I am aware of two ways to enforce security for applications running on the same hardware: (1) at runtime. All current platforms do this by isolating processes using virtual memory. (2) at loadtime. The loader verifies that the code does not do arbitrary memory accesses. Usually enforced by only allowing bytecode with a limited instruction set (e.g., no pointer arithmetic) for a virtual machine (JVM, Smalltalk) instead of binaries containing arbitrary machine code. The author of Fomos doesn't want context switching, memory isolation, etc. And Rust compilers don't produce bytecode. Is there another way?

lugu 3y ago
Wild guess: you could have a single address space shared by all "programs" while using virtual memory to restreint visibility on which page is accessible at a certain time. Like, at runtime, resort on a segfault to check some types of security tokens the caller would to check they are allowed to access the page and make the call. No idea how practical this would be.
- tralarpa 3y ago
  > which page is accessible at a certain time Sounds like a context switch to me :) (at least for the MMU registers)
forgotpwd16 3y ago
https://en.wikipedia.org/wiki/Capability-based_addressing https://en.wikipedia.org/wiki/Capability-based_addressing ?
yencabulator 3y ago
Theseus is an example of (2), in Rust, without bytecode. As far as I understand, done by enforcing no-unsafe etc rules in a blessed compiler, so basically source code becomes the equivalent of the byte code in your thinking. At a glance it's very similar to Midori, but the details of how it's done are quite different. In Theseus, drivers, applications etc are ELF objects, dynamically linked all together into one executable (which is also the kernel), with some neat tricks like hot upgrades. https://github.com/theseus-os/Theseus https://github.com/theseus-os/Theseus https://www.theseus-os.com/ https://www.theseus-os.com/
- vacuity 3y ago
  Theseus is very cool, as are Singularity and Midori. I'm trying to think of how a general-purpose OS could incorporate ideas from these intralingual OSes while allowing other programming languages to be used, without sacrificing security. I haven't gotten anywhere yet because I'm inexperienced.
  - yencabulator 3y ago
    I think the Theseus design would accommodate this in 4 different ways: 1. native Rust modules 2. arbitrary code running in WASM sandbox 3. arbitrary code running in KVM virtualization, perhaps with a Linux kernel there to provide a backwards-compat ABI 4. one can compile the WASM+untrusted app into trustworthy machine code (still implementing the WASM sandboxing logic for the untrusted component); I recall Firefox did this with some image handling C++ code they didn't find trustworthy enough I know the Theseus project is working toward WASM support.

lugu 3y ago

Wild guess: you could have a single address space shared by all "programs" while using virtual memory to restreint visibility on which page is accessible at a certain time. Like, at runtime, resort on a segfault to check some types of security tokens the caller would to check they are allowed to access the page and make the call. No idea how practical this would be.

tralarpa 3y ago
> which page is accessible at a certain time Sounds like a context switch to me :) (at least for the MMU registers)

forgotpwd16 3y ago

https://en.wikipedia.org/wiki/Capability-based_addressing https://en.wikipedia.org/wiki/Capability-based_addressing ?

yencabulator 3y ago

Theseus is an example of (2), in Rust, without bytecode. As far as I understand, done by enforcing no-unsafe etc rules in a blessed compiler, so basically source code becomes the equivalent of the byte code in your thinking. At a glance it's very similar to Midori, but the details of how it's done are quite different. In Theseus, drivers, applications etc are ELF objects, dynamically linked all together into one executable (which is also the kernel), with some neat tricks like hot upgrades. https://github.com/theseus-os/Theseus https://github.com/theseus-os/Theseus https://www.theseus-os.com/ https://www.theseus-os.com/

vacuity 3y ago
Theseus is very cool, as are Singularity and Midori. I'm trying to think of how a general-purpose OS could incorporate ideas from these intralingual OSes while allowing other programming languages to be used, without sacrificing security. I haven't gotten anywhere yet because I'm inexperienced.
- yencabulator 3y ago
  I think the Theseus design would accommodate this in 4 different ways: 1. native Rust modules 2. arbitrary code running in WASM sandbox 3. arbitrary code running in KVM virtualization, perhaps with a Linux kernel there to provide a backwards-compat ABI 4. one can compile the WASM+untrusted app into trustworthy machine code (still implementing the WASM sandboxing logic for the untrusted component); I recall Firefox did this with some image handling C++ code they didn't find trustworthy enough I know the Theseus project is working toward WASM support.