Tomeu Vizoso
November 09, 2017
Reading time:
Last week I played a bit with crosvm, a KVM monitor used within Chromium OS for application isolation. My goal is to learn more about the current limits of virtualization for isolating applications in mainline. Two of crosvm's defining characteristics is that it's written in Rust for increased security, and that uses namespaces extensively to reduce the attack surface of the monitor itself.
It was quite easy to get it running outside Chromium OS (have been testing with Fedora 26), with the only complication being that minijail isn't widely packaged in distros. In the instructions below we hack around the issue with linker environment variables so we don't have to install it properly. Instructions are in form of shell commands for illustrative purposes only.
Build kernel:
$ cd ~/src $ git clone git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git $ cd linux $ git checkout v4.12 $ make x86_64_defconfig $ make bzImage $ cd ..
Build minijail:
$ git clone https://android.googlesource.com/platform/external/minijail $ cd minijail $ make $ cd ..
Build crosvm:
$ git clone https://chromium.googlesource.com/a/chromiumos/platform/crosvm $ cd crosvm $ LIBRARY_PATH=~/src/minijail cargo build
Generate rootfs:
$ cd ~/src/crosvm $ dd if=/dev/zero of=rootfs.ext4 bs=1K count=1M $ mkfs.ext4 rootfs.ext4 $ mkdir rootfs/ $ sudo mount rootfs.ext4 rootfs/ $ debootstrap testing rootfs/ $ sudo umount rootfs/
Run crosvm:
$ LD_LIBRARY_PATH=~/src/minijail ./target/debug/crosvm run -r rootfs.ext4 --seccomp-policy-dir=./seccomp/x86_64/ ~/src/linux/arch/x86/boot/compressed/vmlinux.bin
The work ahead includes figuring out the best way for Wayland clients in the guest interact with the compositor in the host, and also for guests to make efficient use of the GPU.
13/09/2023
Text-to-speech (TTS) models are playing a transformative role, from enriching audiobooks to enhancing podcasts and even improving interactions…
21/08/2023
In Linux, the Industrial Input/Output subsystem manages devices like Analog to Digital Converters, Light sensors, accelerometers, etc. On…
10/08/2023
Collabora's main testing laboratory has grown to automate testing on over 150 devices of about 30 different types. The lab receives job…
09/08/2023
Rust is a modern language known for its memory safety, efficiency, and wide range of high-level features. But many beginners also run into…
03/08/2023
At Collabora, we're committed to bringing people together. That's why we're pushing state-of-the-art machine-learning techniques like Large…
31/07/2023
I have been working on getting U-boot upstream up to speed for the Radxa Rock-5B Rockchip RK3588 board. One of the cool features that I…
Comments (3)
Jun Sun:
Sep 27, 2019 at 09:55 PM
When I tried to build crosvm, I got the following error. Any ideas?
Caused by:
failed to load source for a dependency on `audio_streams`
Reply to this comment
Reply to this comment
junyu:
Mar 04, 2021 at 07:23 PM
yes,i got a same ERR...How can I fix it?
Reply to this comment
Reply to this comment
Tomeu Vizoso:
Mar 05, 2021 at 05:39 AM
Changes in Crosvm have introduced new dependencies. I would recommend nowadays to base on this Dockerfile when building Crosvm: https://gitlab.freedesktop.org/virgl/virglrenderer/-/blob/master/perf-testing/Docker/Dockerfile.
More instructions here: https://gitlab.freedesktop.org/virgl/virglrenderer/-/blob/master/perf-testing/README.md
Reply to this comment
Reply to this comment
Add a Comment