Ed Schouten

One of the fundamental problems with UNIX-like operating systems is that they don't seem to make it easy and intuitive to develop applications that are strongly hardened against exploits through sandboxing. With CloudABI, we're trying to make this process a lot easier, by having an environment that is purely based on capability-based security.

In another talk in the main track I'm going to give a more general talk about CloudABI, explaining what the mindset behind the project. During this talk in the BSD devroom I want to focus on one specific aspect, namely how FreeBSD's runtime environment for CloudABI works.

CloudABI is a simplified POSIX-like runtime environment that is inspired by FreeBSD's Capsicum. It allows you to create programs that can solely interact with the environment through file descriptors (capabilities). Compared to traditional UNIX-like systems, this approach has three advantages:

1. It reduces the impact of exploits. If an attacker manages to take over control of a CloudABI application, it can only access those resources that the application was designed to use (for a networked service: typically an already bound TCP socket and some data directories). This is different from most traditional UNIX-like systems, where an attacker would gain access to all resources that the user running the application can access, which is very broad.
2. It makes applications easier to test. By knowing that an application can only access those resources that are provided explicitly, the entire environment in which the application runs can be customized for testing.
3. Similarly, it makes applications easier to deploy. This model tends to reduce the need for using containers and virtual machines. Applications can be started directly, while still providing the necessary isolation from the rest of the system.

An interesting aspect of CloudABI is that it's cross-platform. You can compile a CloudABI program once and run exactly the same executable both on FreeBSD, macOS and Linux. In this talk I want to focus on this specifically: how is FreeBSD capable of running these programs? Topics I'll be covering during this talk include:

• FreeBSD's image activator framework: the code that parses and loads executables.
• The ELF file format
• System calls and system call tables
• vDSOs: Virtual Dynamic Shared Objects

One of the fundamental problems with UNIX-like operating systems is that they don't seem to make it easy and intuitive to develop applications that are strongly hardened against exploits through sandboxing. With CloudABI, we're trying to make this process a lot easier.

CloudABI is a blend of POSIX and pure capability-based security, which allows you to create applications that are only capable of accessing those things that they are designed to use. As you'll see, software also becomes easier to test and deploy as a result of using this model.

In this presentation I am going to discuss a project I've been working on over the last two years, called CloudABI. CloudABI is a simplified POSIX-like runtime environment that is inspired by FreeBSD's Capsicum. It allows you to create programs that can solely interact with the environment through file descriptors (capabilities). Compared to traditional UNIX-like systems, this approach has three advantages:

1. It reduces the impact of exploits. If an attacker manages to take over control of a CloudABI application, it can only access those resources that the application was designed to use (for a networked service: typically an already bound TCP socket and some data directories). This is different from most traditional UNIX-like systems, where an attacker would gain access to all resources that the user running the application can access, which is very broad.

2. It makes applications easier to test. By knowing that an application can only access those resources that are provided explicitly, the entire environment in which the application runs can be customized for testing.

3. Similarly, it makes applications easier to deploy. This model tends to reduce the need for using containers and virtual machines. Applications can be started directly, while still providing the necessary isolation from the rest of the system.

In this talk I'm going to explain how CloudABI works in detail, while also discussing some of its design decisions. I'll also show how you can design your own CloudABI programs.

CloudABI is available for Linux, FreeBSD and Mac OS X. A NetBSD port also exists.

CloudABI is an alternative runtime environment for UNIX-like operating systems that is purely based on the principle of capability-based security. This makes it possible to create applications that are strongly sandboxed, easier to test and easier to maintain.

UNIX-like operating systems don't seem to make it easy to sandbox programs to harden them against exploits. They also don't allow you to run untrusted executables directly without compromising security, which is the reason why we require technology like virtual machines and containers to secure our systems. I am going to talk about a system I am developing called CloudABI. CloudABI is a simplified POSIX-like runtime environment that is inspired by FreeBSD's Capsicum. It allows you to create exectables that can solely interact with the environment through file descriptors (capabilities). This not only makes CloudABI more secure than the traditional POSIX runtime, it also makes it easier to test programs through dependency injection. This makes CloudABI a perfect environment for developing microservices. In my presentation I am going to focus on how CloudABI works, how you can develop software for it and how it works in practice.