We're hiring!
*

Quick hack: Experiments with crosvm

Tomeu Vizoso avatar

Tomeu Vizoso
November 09, 2017

Share this post:

Reading time:

Last week I played a bit with crosvm, a KVM monitor used within Chromium OS for application isolation. My goal is to learn more about the current limits of virtualization for isolating applications in mainline. Two of crosvm's defining characteristics is that it's written in Rust for increased security, and that uses namespaces extensively to reduce the attack surface of the monitor itself.

It was quite easy to get it running outside Chromium OS (have been testing with Fedora 26), with the only complication being that minijail isn't widely packaged in distros. In the instructions below we hack around the issue with linker environment variables so we don't have to install it properly. Instructions are in form of shell commands for illustrative purposes only.

Build kernel:

    $ cd ~/src
    $ git clone git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
    $ cd linux
    $ git checkout v4.12
    $ make x86_64_defconfig
    $ make bzImage
    $ cd .. 

Build minijail:

    $ git clone https://android.googlesource.com/platform/external/minijail
    $ cd minijail
    $ make
    $ cd .. 

Build crosvm:

    $ git clone https://chromium.googlesource.com/a/chromiumos/platform/crosvm
    $ cd crosvm
    $ LIBRARY_PATH=~/src/minijail cargo build 

Generate rootfs:

    $ cd ~/src/crosvm
    $ dd if=/dev/zero of=rootfs.ext4 bs=1K count=1M
    $ mkfs.ext4 rootfs.ext4
    $ mkdir rootfs/
    $ sudo mount rootfs.ext4 rootfs/
    $ debootstrap testing rootfs/
    $ sudo umount rootfs/

Run crosvm:

    $ LD_LIBRARY_PATH=~/src/minijail ./target/debug/crosvm run -r rootfs.ext4 --seccomp-policy-dir=./seccomp/x86_64/ ~/src/linux/arch/x86/boot/compressed/vmlinux.bin

The work ahead includes figuring out the best way for Wayland clients in the guest interact with the compositor in the host, and also for guests to make efficient use of the GPU.

 

Original post

Comments (3)

  1. Jun Sun:
    Sep 27, 2019 at 09:55 PM

    When I tried to build crosvm, I got the following error. Any ideas?

    Caused by:
    failed to load source for a dependency on `audio_streams`

    Reply to this comment

    Reply to this comment

      1. Tomeu Vizoso:
        Mar 05, 2021 at 05:39 AM

        Changes in Crosvm have introduced new dependencies. I would recommend nowadays to base on this Dockerfile when building Crosvm: https://gitlab.freedesktop.org/virgl/virglrenderer/-/blob/master/perf-testing/Docker/Dockerfile.

        More instructions here: https://gitlab.freedesktop.org/virgl/virglrenderer/-/blob/master/perf-testing/README.md

        Reply to this comment

        Reply to this comment


Add a Comment






Allowed tags: <b><i><br>Add a new comment:


Search the newsroom

Latest Blog Posts

Building a Board Farm for Embedded World

27/06/2024

With each board running a mainline-first Linux software stack and tested in a CI loop with the LAVA test framework, the Farm showcased Collabora's…

Smart audio filters with WirePlumber 0.5

26/06/2024

WirePlumber 0.5 arrived recently with many new and essential features including the Smart Filter Policy, enabling audio filters to automatically…

The latest on cmtp-responder, a permissively-licensed MTP responder implementation

12/06/2024

Part 3 of the cmtp-responder series with a focus on USB gadgets explores several new elements including a unified build environment with…

A roadmap for VirtIO Video on ChromeOS: part 3

06/06/2024

The final installment of a series explaining how Collabora is helping shape the video virtualization story for Chromebooks with a focus…

Hacking on the PipeWire GStreamer elements

05/06/2024

Last week I attended the GStreamer spring hackfest in Thessaloniki to work on the PipeWire GStreamer elements and connect with the community.

Transforming speech technology with WhisperLive

28/05/2024

The world of AI has made leaps and bounds from what It once was, but there are still some adjustments required for the optimal outcome.…

Open Since 2005 logo

Our website only uses a strictly necessary session cookie provided by our CMS system. To find out more please follow this link.

Collabora Limited © 2005-2024. All rights reserved. Privacy Notice. Sitemap.