Unikraft

Kuenzer, Simon; Bădoiu, Vlad-Andrei; Lefeuvre, Hugo; Santhanam, Sharan; Jung, Alexander; Gain, Gaulthier; Soldani, Cyril; Lupu, Costin; Teodorescu, Stefan Lucian; Răducanu, Costi; Banu, Cristian; Mathy, Laurent; Deaconescu, Răzvan; Raiciu, Costin; Huici, Felipe

doi:10.1145/3447786.3456248

Cited by 53 publications

(7 citation statements)

References 47 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…The OS allows easy extension to new isolation mechanisms. Further, its design is based on the Unikraft [19] unikernel, so it inherits its high performance, small attack surface, and good compatibility with popular applications. We ported FlexOS to the Morello platform, and implemented on top of it the two compartmentalization abstractions described earlier, in a total of about 2200 lines of code.…”

Section: Methodsmentioning

confidence: 99%

Software Compartmentalization Trade-Offs with Hardware Capabilities

Kressel,

Lefeuvre,

Olivier

2023

Proceedings of the 12th Workshop on Programming Languages and Operating Systems

Self Cite

View full text Add to dashboard Cite

Compartmentalization is a form of defensive software design in which an application is broken down into isolated but communicating components. Retrofitting compartmentalization into existing applications is often thought to be expensive from the engineering effort and performance overhead points of view. Still, recent years have seen proposals of compartmentalization methods with promises of low engineering efforts and reduced performance impact. ARM Morello combines a modern ARM processor with an implementation of Capability Hardware Enhanced RISC Instructions (CHERI) aiming to provide efficient and secure compartmentalization. Past works exploring CHERI-based compartmentalization were restricted to emulated/FPGA prototypes.In this paper, we explore possible compartmentalization schemes with CHERI on the Morello chip. We propose two approaches representing different trade-offs in terms of engineering effort, security, scalability, and performance impact. We describe and implement these approaches on a prototype OS running bare metal on the Morello chip, compartmentalize two popular applications, and investigate the performance overheads. Furthermore, we show that compartmentalization can be achieved with an engineering cost that can be quite low if one is willing to trade off on scalability and security, and that performance overheads are similar to other intra-address space isolation mechanisms.CCS Concepts: • Security and privacy → Security in hardware; Operating systems security; Software and application security.

show abstract

Section: Methodsmentioning

confidence: 99%

Software Compartmentalization Trade-Offs with Hardware Capabilities

Kressel,

Lefeuvre,

Olivier

2023

Proceedings of the 12th Workshop on Programming Languages and Operating Systems

Self Cite

View full text Add to dashboard Cite

show abstract

“…OpenCom [25] 也采用了一种基于组件的方式创建系统软件, 它定义了一个最小的运行时内核, 可以自由定制所需的组件, 其优势在于考虑了兼容不同的硬件部署环境, 由硬件环境提供者提供模块的加载器与链接器, 系统应用的开发者再基于此开发应用程序. Unikraft [26] 是开源的库操作系统 (Library OS), 支持选择内核组件定制化单地址空间的操作系统内核, 不过主要面向云端虚拟机应用, 依赖于运行在主机操作系统 Linux 之上. FlexOS [27] 提出一种操作系统隔离性可配置方法, 支持多种软硬协同的隔离机制, 重点关注内核的安全性与可靠性.…”

Section: 相关工作unclassified

BrickOS: specialized kernels for heterogeneous hardware resources

GU,

LI,

XIA

et al. 2024

Sci. Sin.-Inf.

View full text Add to dashboard Cite

QNX 操作系统 [3] 是成功的微内核操作系统代表, 其广泛部署于汽车等高可靠领域. 学术界成功的 L4 微内核操作系统 [5] 也衍生出世界上第 1 个经过形式化验证的微内核 seL4 [6] , 应用于德国政府安全手机的操作系统等. 不过, 微内核架构由于较强的隔离性而在时延与性能方面存在不足之处. 近年来, 国内外工业界对微内核操作系统的研发愈发积极, 例如谷歌 (Google) 公司发布的 Fuchsia 操作系统 4) 、华为公司发布的鸿蒙操作系统 5) (面向车载领域鸿蒙 VOS 是华为自研的微内核操作系统) 等.简要内核架构将应用程序与操作系统运行在相同特权级别和地址空间中, 主要面向不支持地址空间隔离和特权隔离等功能的嵌入式计算平台. 该架构操作系统的典型代表是 MS-DOS (microsoft disk operating system) [7] . 这种架构的一个优势在于应用程序和操作系统之间的交互简单且快速, 因为没有权限级别和地址空间的隔离; 但也正因如此, 应用程序中的错误可能直接导致整个系统崩溃. 除了 MS-DOS 外, 采用该架构的操作系统还包括 FreeRTOS 等, 它们主要运行在微控制单元等相对比较简单的硬件设备上.外核 (exokernel) [8] 又被称为极限内核, 其设计理念是操作系统内核不应该对硬件资源进行过度地抽象, 因为过于通用的抽象难以有效契合于各种应用程序需求. 该架构旨在使应用程序拥有选择硬件资源抽象的能力, 因为应用程序知道什么样的硬件抽象对自身的运行是最佳选择. 该架构的实现方式是通过将硬件抽象封装到与应用程序直接链接的库操作系统 (LibOS) [9,10] 中, 而库操作系统是应用程序开发人员自主配置或者是自行开发的. 在运行时, 库操作系统和应用程序运行在同一个地址空间中且运行在用户态, 外核不提供具体抽象而仅负责保证多个应用程序 (多个库操作系统) 能够安全且高效地共享硬件资源. 外核架构的应用范围局限性较多, 目前主要是在嵌入式场景和轻量级虚拟机中有一些应用. 面向较复杂的场景, 库操作系统将会变得非常复杂, 甚至相当于一个完整的宏内核, 从而丧失外核架构本身的优势. 目前, 在工业互联网和智能物联网中, 不同内核架构的操作系统均有部署, 比如基于宏内核架构的 Windows, Linux, VxWorks, MindSphere 6) , Android Things [11] , SylixOS 7) ; 基于微内核架构的 QNX [3] , Zephyr 8) , RT-Thread 9) ; 基于简要内核架构的 FreeRTOS、华为 LiteOS-M 10) , 不过它们尚缺乏对于异构计算平台的灵活适应能力.面向异构硬件平台, 操作系统学术界研究者还提出过多内核架构 (包括 fos [12] , Akaros [13] ,4) Google. Fuchsia. https://fuchsia.dev.

show abstract

“…FlexOS Architecture. FlexOS is based on a modular LibOS (Unikraft, a unikernel framework [30]) and allows fined-grained OS software modules to be placed in compartments (see Figure 2). Note that the granularity of such modules is much more fine-grained than that of traditional microkernel/multiserver OSes.…”

Section: When To Enable Sh?mentioning

confidence: 99%

“…In operating systems, the current landscape (illustrated on Figure 1) broadly consists of micro-kernels [24,29], which favor hardware protection and verification over performance, monolithic kernels [8], which choose privilege separation and address spaces to isolate apps, but assume all kernel code is trusted, and single-address-space OSes (SASOSes), which attempt to bring isolation within the address space [10,23,32], or dump all protection for maximum performance [30,36,43].…”

Section: Introductionmentioning

confidence: 99%

FlexOS

Lefeuvre

Bădoiu

Teodorescu

et al. 2021

Proceedings of the Workshop on Hot Topics in Operating Systems

Self Cite

View full text Add to dashboard Cite

OS design is traditionally heavily intertwined with protection mechanisms. OSes statically commit to one or a combination of (1) hardware isolation, (2) runtime checking, and (3) software verification early at design time. Changes after deployment require major refactoring; as such, they are rare and costly. In this paper, we argue that this strategy is at odds with recent hardware and software trends: protections break (Meltdown), hardware becomes heterogeneous (Memory Protection Keys, CHERI), and multiple mechanisms can now be used for the same task (software hardening, verification, HW isolation, etc). In short, the choice of isolation strategy and primitives should be postponed to deployment time.We present FlexOS, a novel, modular OS design whose compartmentalization and protection profile can seamlessly be tailored towards a specific application or use-case at build time. FlexOS offers a language to describe components' security needs/behavior, and to automatically derive from it a compartmentalization strategy. We implement an early prototype of FlexOS that can automatically generate a large array of different OSes implementing different security strategies. CCS Concepts• Software and its engineering → Operating systems; • Security and privacy → Operating systems security.

show abstract

Unikraft

Cited by 53 publications

References 47 publications

Software Compartmentalization Trade-Offs with Hardware Capabilities

Software Compartmentalization Trade-Offs with Hardware Capabilities

BrickOS: specialized kernels for heterogeneous hardware resources

FlexOS

Contact Info

Product

Resources

About