Rainbow

english | español

HowTo [ID# 210022]  +/-

Translate this page with Google -español -български -中文（中国大陆） -中文（臺灣） -hrvatski -čeština -dansk -Nederlands -suomi -français -Deutsch -Ελληνικά -हिन्दी -italiano -日本語 -한국어 -norsk -polski -português -română -русский -svenska

Introduction

git :: sources :: rainbow-0.8.4.tar.bz2 :: announcement

The Bitfrost security specification argues that existing desktop security conventions do not meet the security needs of adventurous kids in 1-1 computing programs, of the technical staff who help maintain such initiatives, and of the political constituencies which determine where such programs take place. The most serious inadequacy of such systems is that they force end-users to take unnecessary security risks (for example, giving all programs a user runs access to the network, to auto-start facilities, and to other programs' data files) while simultaneously denying users the opportunity to do things which can be done safely but which were not anticipated by the system administrator (notably, installing new software or modifying the local system.) Consequently, we wrote Rainbow.

Rainbow is an isolation shell. This means two things:

1. shell: Rainbow runs programs on behalf of humans and programs. Rainbow provides those programs with a suitable environment: places in which temporary and persistent data can be stored, environment variables to identify those places, etc.
2. isolation: People and programs should use Rainbow when they want to isolate programs from other programs and important system resources. "Isolation" is already a familiar concept to most UNIX programmers: many system daemons already operate using their own unique UID and/or GID, and most have private places in which they store their configuration. Rainbow generalizes and extends this paradigm by providing every program it runs with a unique identity, with private storage, with pre-configured resource usage limits, etc.

At the moment, Rainbow only knows how to provide the same primitive form of filesystem and signal isolation that competent sysadmins provide to users of multi-user Unix shell servers.

However, contributions are welcome, particularly contributions which advance existing plans.

Further Information

• Information for Activity Developers
• Information about Rainbow's current design and implementation.
• Information about older designs
• installation instructions
• Rainbow/Testing
• Rainbow/Next Steps
• Rainbow/Curiosities

Next Steps

Last updated: Michael Stone 21:59, 16 May 2009 (UTC)

Job control features

There are a couple of small impedance mismatches that will need to be overcome; e.g. sugar needs a way to kill an activity, a way to garbage-collect dead jails.

D-Bus changes for sugar activities

We need to find a way to make dbus session buses happy accepting connections from per-bus groups of users.

The current plan is to implement a "group_pattern" authorization attribute and to have libnss_rainbow synthesize the appropriate group memberships. We'll start with positive and negative automated tests.

Ben Schwartz points out that this functionality could also be hacked together with the regular allow-group authorization element if only dbus session buses sourced per-user configuration.

sugar-jhbuild integration

Sugar folks have asked for jhbuild integration to ease testing. Maybe some kind soul will donate it?

P_NETWORK

We'd like to have the option to restrict a program's access to the network. James Morris suggests that we check out unshare(CLONE_NEWNET).

See Isolation LSM, http://lkml.org/lkml/2009/1/7/18, and http://lkml.org/lkml/2009/1/7/613 for some other approaches.

P_DOCUMENT*

Requested by Gary C. Martin. To implement this, we need to put some authorization gates in the datastore, then somehow record which data should be accessible to which activities. (Or maybe we could do it all with ACLs?)

See Olpcfs, Journal reloaded, Olpcfs2, and Journal and Overlays for some other approaches.

P_X

http://dev.laptop.org/git/users/mstone/security/log/?h=xephyr contains very rough patches which cause rainbow to generate Xephyrs in which to isolate some of its clients' X abuse.

-- NB: Recent versions of Xephyr (>=1.5.99) are required for OpenGL clients.

-- Also, Firefox doesn't yet like Xephyr. Help debugging would be greatly appreciated.

Future work: try out XSECURITY on the main xserver (i.e. by making activities untrusted clients) and see where that leaves us. Then on to XACE as per previous discussion

-- unfortunately, it seems (c.f. ssh man page) that most apps break when you treat them as untrusted clients. Hmm.

Demo Ideas

• (paraphrase): "The insight behind Rainbow is that the problem of isolating an operator from his/her programs is similar to the problem of isolating users of a shared server from one another and from root." -- C. Scott Ananian
• "I see the cool parts [of Rainbow] as (1) per-instance isolation, (2) isolation without virtualization, and (3) isolation using the uid mechanisms. All three are unique and impressive." -- Ben Schwartz

(NB: Actually, lots of other people have played with these ideas. plash is a compelling example.)

Ideas:

• Give people an isolated Terminal to play in.
• Show off rlimits with a fork-bomb.
• Show off filesystem protections -- rm -rf, restriction of readable dirs, etc.

Items of Historical Interest

• README - A description of the original scope and design of Rainbow.
• Notes - Notes on design and hurdles in developing Rainbow.
• Rainbow/DataStore Access - thoughts on datastore access mechanisms, superseded by Olpcfs.
• "Why not SELinux?"
• "Bitfrost Compliance for Update.1" announcement mail
• #2732, #2906, #4184 - influential tickets in the history of rainbow