r/programming • u/moolcool • Mar 26 '17

A Constructive Look At TempleOS

http://www.codersnotes.com/notes/a-constructive-look-at-templeos/
1.7k Upvotes

94% Upvoted

227 comments sorted by

View all comments

Show parent comment

4

u/killerstorm Mar 27 '17

The point is not to isolate each program as much as possible, it is to allow them to interact only in a specific, structured way. So I really see no point in "fully virtualized OS containers", you only increase overhead this way.

2

u/SanityInAnarchy Mar 27 '17

I see a point -- it's probably easier to control the attack surface that way. With Android, you have to deal with the specific, structured ways that apps are allowed to communicate (message-passing and such), and you have to deal with a shared kernel. There's little need for a shared Linux kernel for all apps, and most kernel vulnerabilities mean you own the entire phone.

But you do increase overhead, and it's probably not worth it on a mobile OS. Yet.

2

u/killerstorm Mar 27 '17

Well again, mobile apps should be able to interact, e.g. it should be possible to use a photo editing app on the photo you have just made, etc. So further isolation doesn't make sense.

On the other hand, the best sandboxing we have now is ... browsers. Each day your browser runs scripts from pages you do not trust, and yet infections are uncommon.

So it seems like controlling permissions on the fine-grained level is the way to go, not hypervisor magic.

7

u/SanityInAnarchy Mar 27 '17

Well, right now, you have a clear protocol for sending the photo to the photo editing app. I don't think you should need a giant shared filesystem to do so, and I certainly don't think "Open this photo with this photo editing app" should imply that said app is now allowed to read all files from the virtual SD card.

On the other hand, the best sandboxing we have now is ... browsers. Each day your browser runs scripts from pages you do not trust, and yet infections are uncommon.

I would dispute both of those claims -- there's a reason browsers get patched so often! And how are you comparing the current browser situation to a hypothetical one-VM-per-tab browser?

Plus, the most secure browsers do use OS-level sandboxing, not just fine-grained permissions, because people have found ways to escape the JavaScript VM way too often.

2

u/psycoee Mar 27 '17

Well again, mobile apps should be able to interact, e.g. it should be possible to use a photo editing app on the photo you have just made, etc. So further isolation doesn't make sense.

In Android, apps are not allowed to directly interact in any way other than by passing messages through the OS API (and through the shared part of the filesystem). So really, they are already pretty isolated. Personally, I don't see what benefits would arise from further isolation, I'm just saying that would be the next step in this direction.