November 09, 2017
Last week I played a bit with crosvm, a KVM monitor used within Chromium OS for application isolation. My goal is to learn more about the current limits of virtualization for isolating applications in mainline. Two of crosvm's defining characteristics is that it's written in Rust for increased security, and that uses namespaces extensively to reduce the attack surface of the monitor itself.
It was quite easy to get it running outside Chromium OS (have been testing with Fedora 26), with the only complication being that minijail isn't widely packaged in distros. In the instructions below we hack around the issue with linker environment variables so we don't have to install it properly. Instructions are in form of shell commands for illustrative purposes only.
$ cd ~/src $ git clone git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git $ cd linux $ git checkout v4.12 $ make x86_64_defconfig $ make bzImage $ cd ..
$ git clone https://android.googlesource.com/platform/external/minijail $ cd minijail $ make $ cd ..
$ git clone https://chromium.googlesource.com/a/chromiumos/platform/crosvm $ cd crosvm $ LIBRARY_PATH=~/src/minijail cargo build
$ cd ~/src/crosvm $ dd if=/dev/zero of=rootfs.ext4 bs=1K count=1M $ mkfs.ext4 rootfs.ext4 $ mkdir rootfs/ $ sudo mount rootfs.ext4 rootfs/ $ debootstrap testing rootfs/ $ sudo umount rootfs/
$ LD_LIBRARY_PATH=~/src/minijail ./target/debug/crosvm run -r rootfs.ext4 --seccomp-policy-dir=./seccomp/x86_64/ ~/src/linux/arch/x86/boot/compressed/vmlinux.bin
The work ahead includes figuring out the best way for Wayland clients in the guest interact with the compositor in the host, and also for guests to make efficient use of the GPU.
With the release of virglrenderer 0.8.0, getting accelerated OpenGL within a virtual machine (VM) made a big leap forward. Since virglrenderer-0.7.0,…
Ongoing work on the reverse-engineered Panfrost OpenGL ES driver for Arm Mali GPUs has turned the RK3399 SoC into a very attractive platform…
As part of its unwavering commitment to open source and open standards, Collabora is proud to be part of bringing the recently-released…
There's been quite a few updates to Zink, an OpenGL implementation on top of Vulkan, since I last wrote about it. Here's an overview of…
A little over a month and a half ago, Collaborans including Aaron Boxer, George Kiagiadakis, Guillaume Desmottes, Stéphane Cerveau and myself…
In my last Panfrost blog post, I announced my internship goal: improve Panfrost to run GNOME3. GNOME is a popular Linux desktop making heavy…