Open dckc opened 5 years ago
2020-05-28 Genode OS Framework 20.05 with Capability-based security using seccomp on Linux, https://genode.org/documentation/release-notes/20.05#Capability-based_security_using_seccomp_on_Linux
"All Genode processes get restricted to just 25 syscalls on x86," https://github.com/genodelabs/genode/blob/78497c03ca3640e78a6d6f21be2bbd6a446dd458/tool/seccomp/seccomp_bpf_compiler.h#L84
~ehmry/genodepkgs uses nix to build packages for genode. And if that isn't cool enough, it uses dhall on top.
I updated from d086d68 Jan 24 to 46c65613. My first attempt to build didn't get far:
connolly@jambox:~/projects/genodepkgs$ nix build .#checks.x86_64-linux.nova-x86
warning: unknown setting 'experimental-features'
error: don't know what to do with argument '.#checks.x86_64-linux.nova-x86'
Try 'nix --help' for more information.
so I tried nix upgrade-nix
to version 2.3.5 but still no joy:
[nix-shell:~/projects/genodepkgs]$ nix flake show .
warning: flake 'git+file:///home/connolly/projects/genodepkgs?ref=master&rev=46c65613022be76c938f1541a07dc5552b4b64d2' has deprecated attribute 'edition'
error: unexpected flake input attribute 'uri', at /nix/store/3r3000m61d24kv399h6znqg2cgb9qyq8-source/flake.nix:8:3
Based on Nix Flakes, Part 1: An introduction and tutorial I went into nix-shell -I nixpkgs=channel:nixos-20.03 -p nixFlakes
but lost again. Then I changed .uri
to .url
and that seemed to make it happy.
ehmry/nixpkgs/tarball
was really slow (it's not that big but github didn't seem to want to serve it up quickly). It got there just as I was about to give up on it.building cmake-3.16.5
. odd... that's not in a build cache? woah! CPU is pegged. all of them![1/15/118 built, 537 copied (3663.9/3665.8 MiB), 657.6 MiB DL] building libbfd-2.31.1
building llvm-8.0.1
ugh. am I cross-compiling for genode? I wonder how to tellbuilding llvm-8.0.1
stillgenodepkgs does not provide attribute checks... — sourcehut lists
connolly@jambox:~/projects/genodepkgs$ git log -n1 --pretty='%h %ai %s'
d086d68 2020-01-24 19:05:45 +0100 Update genode-depot flake
connolly@jambox:~/projects/genodepkgs$ ls -ltr
total 44
-rw-rw-r-- 1 connolly connolly 6157 Jan 24 19:34 README.md
...
Be aware that CloudABI still uses the %fs (or %gs on Darwin) segment register for TLS. For performance reasons these registers are not retained across context switches for the NOVA kernel, if not other L4 kernels. Unfortunately CloudABI binary compatibility is not possible with Genode and x86. ARM might be different story however.
Good to know about CloudABI vs. genode but CloudABI seems to be losing steam. And the they way genode support for linux has upgraded from a dev platform to actually having pretty good security properties makes this combination a lot more interesting.
So I'm re-scoping this issue... Um... Oops... I guess the genodepkgs is the other way around: linux on genode.
how analagous is cloudabi to noux?
how about https://github.com/seL4/refos ?
mem_map looks tricky.
https://github.com/genodelabs/genode/blob/master/repos/ports/src/lib/libc_noux/plugin.cc#L1025
slide 11 of https://www.slideshare.net/sartakov/genode-compositions
Related
144
49