Rainbow: Difference between revisions

From OLPC
Jump to navigation Jump to search
mNo edit summary
Line 14: Line 14:


* P_NETWORK -- [[Isolation LSM]]
* P_NETWORK -- [[Isolation LSM]]
* cli interface: [http://dev.laptop.org/git?p=users/mstone/security;hb=cli;a=log]
* cli interface: [http://dev.laptop.org/git?p=users/mstone/security;hb=cli;a=log rainbow-cli]
* pristine root patches -- [http://dev.laptop.org/git/users/mstone/nss-rainbow nss-rainbow]
* pristine root patches -- [http://dev.laptop.org/git/users/mstone/nss-rainbow nss-rainbow]
* P_DOCUMENT -- [[Olpcfs]]
* P_DOCUMENT -- [[Olpcfs]]
* P_X -- we'll start by trying out XSECURITY (i.e. by making activities untrusted clients) and see where that leaves us. Then on to XACE as per [http://lists.laptop.org/pipermail/security/2008-April/000390.html]
* P_X -- we'll start by trying out XSECURITY (i.e. by making activities untrusted clients) and see where that leaves us. Then on to XACE as per [http://lists.laptop.org/pipermail/security/2008-April/000390.html previous discussion]


== (Outdated) Resources ==
== (Outdated) Resources ==

Revision as of 20:47, 18 September 2008

  english | español HowTo [ID# 164418]  +/-  


Introduction

Rainbow implements the isolation shell implicitly described in the Bitfrost security specification. This means that it isolates activities (and eventually system services) that it is asked to run from one another and the rest of the system.

Rainbow implements this isolation by generating a new uid (and perhaps a new gid) for each program it is asked to run. Running each activity as a separate user means that standard Unix access checks can be used as the primary 'gate' to control the visibility of activity-driven side-effects like reading from or writing to files or devices or signalling other processes.

Design and Implementation

The basic design principles of the present 0.7-series incarnation of rainbow were presented in rainbow.txt. The implementation of rainbow can be found alongside that file in the "rainbow/rainbow" subdirectory of security git repo and in its several forks. Finally, a somewhat dated guided tour of the source code is available.

Next Steps

(Outdated) Resources