EsseOS

Abstract

Cloud computing offers a pay-per-use model and elasticity for hosted applications. The latter demands for decomposing an application into services, where each of them is executed by dedicated virtual machines. Typically, off-the-self operating systems (e.g., Linux) and managed runtime support (e.g., Java) are utilized thereby causing an unnecessary huge code base, resulting in a rather large attack surface.To address these problems, we present EsseOS, a platform for tailoring services as well as their associated runtime environment. EsseOS aims at reducing the attack surface by adapting the entire software stack that runs in a virtual machine to capture only the functionally essentially needed. This is achieved by following a clean-slate approach leveraging the advantages of Haskell, a functional programming language. We structure our software to be reconfigurable to remove unnecessary parts while still ensuring correct interaction between features by relying on Haskell's advanced type system. Initial results indicate an order of magnitude smaller code base for a tailored version of both Memcached and its execution environment compared to the original Cbased version running on top of Linux.