Rainbow

From OLPC
Revision as of 22:46, 24 January 2008 by Mstone (talk | contribs)
Jump to navigation Jump to search
  english | español HowTo [ID# 101205]  +/-  


Rainbow implements the isolation shell implicitly described in the Bitfrost security specification. This means that it isolates activities (and eventually system services) that it is asked to run from one another and the rest of the system.

Rainbow implements this isolation by generating a new uid (and perhaps a new gid) for each program it is asked to run. Running each activity as a separate user means that standard Unix access checks can be used as the primary 'gate' to control the visibility of activity-driven side-effects like reading from or writing to files or devices or signalling other processes.

Resources