Rainbow: Difference between revisions
No edit summary |
|||
| Line 1: | Line 1: | ||
{{translations}} |
{{translations}} |
||
Rainbow implements the isolation shell implicitly described in the [[Bitfrost]] security specification. |
Rainbow implements the isolation shell implicitly described in the [[Bitfrost]] security specification. This means that it isolates activities (and eventually system services) that it is asked to run from one another and the rest of the system. |
||
Rainbow implements this isolation by generating a new uid (and perhaps a new gid) for each program it is asked to run. Running each activity as a separate user means that standard Unix access checks can be used as the primary 'gate' to control the visibility of activity-driven side-effects like reading from or writing to files or devices or signalling other processes. |
|||
Rainbow: |
|||
Finally, "rainbow" is also the name of the [[Build system#Build Branches|build branch]] into which this isolation shell is being integrated. |
|||
* Negotiates launching activities and creating a secure, minimal environment for their operation inside a 'Container', a way of isolating one activity from another. This includes limiting the scope of Filesystem, Network Access, and CPU time that each activity has access to. |
|||
* Creates a means for Updates to happen in a reliable and secure way. |
|||
* Provides interfaces to VServer and other libraries that make the above possible. |
|||
== Installing == |
== Installing == |
||
| Line 22: | Line 21: | ||
* [http://dev.laptop.org/git?p=security;a=blob;f=rainbow/README;h=5e7f1051b43292a7af8bb0c6ae72987ad5d89b18;hb=HEAD README] - A description of the scope and design of Rainbow. |
* [http://dev.laptop.org/git?p=security;a=blob;f=rainbow/README;h=5e7f1051b43292a7af8bb0c6ae72987ad5d89b18;hb=HEAD README] - A description of the scope and design of Rainbow. |
||
* [http://dev.laptop.org/git?p=security;a=blob;f=rainbow/NOTES;h=5277468b760c7d92d6713f5c0b6939ebf0978f2b;hb=HEAD Notes] - Useful notes on design and hurdles in developing Rainbow. |
* [http://dev.laptop.org/git?p=security;a=blob;f=rainbow/NOTES;h=5277468b760c7d92d6713f5c0b6939ebf0978f2b;hb=HEAD Notes] - Useful notes on design and hurdles in developing Rainbow. |
||
== README == |
|||
<gitembed>security||rainbow/README||660||600</gitembed> |
|||
[[category:software]] |
[[category:software]] |
||
Revision as of 18:54, 3 November 2007
Rainbow implements the isolation shell implicitly described in the Bitfrost security specification. This means that it isolates activities (and eventually system services) that it is asked to run from one another and the rest of the system.
Rainbow implements this isolation by generating a new uid (and perhaps a new gid) for each program it is asked to run. Running each activity as a separate user means that standard Unix access checks can be used as the primary 'gate' to control the visibility of activity-driven side-effects like reading from or writing to files or devices or signalling other processes.
Finally, "rainbow" is also the name of the build branch into which this isolation shell is being integrated.
Installing
To install Rainbow, either directly install a build from the Rainbow build branch or use the network updater to migrate to a build from that branch.
# olpc-update rainbow-NNN
Resources
- Taste the Rainbow: A guided tour of the source code of the rainbow-0.7.0 release.
- OLPC Bitfrost: Bitfrost Spec
- README - A description of the scope and design of Rainbow.
- Notes - Useful notes on design and hurdles in developing Rainbow.