Linked by nfeske on Thu 29th Nov 2012 17:38 UTC
Permalink for comment 543743
RE[3]: I feel like a thicko
by nfeske on Fri 30th Nov 2012 19:15 UTC in reply to "RE[2]: I feel like a thicko"
Member since:

Your questions are spot-on. Let me try to cover them one by one.


A Genode system is a tree of processes. When booting up, there is only the root of the tree that we call "core". Core runs directly on the kernel (e.g., Linux or a microkernel) and owns all physical resources like RAM and devices. After having started up, core creates the so-called init process, which becomes thereby a child of core. But in contrast to Unix where a forked process inherits the privileges and identity of the forking process, a Genode child process has no privileges at all when created. The only thing such a process can do, is to send messages to its immediate parent (the one who just created the process). The parent can then decide to respond to such messages in any way the parent sees fit, e.g., it can grant specific permissions to the child. Conceptually, the child process is like a virtual machine and the parent process is like its virtual-machine monitor. Now, the cool thing is that the child process, in turn, can again create child processes using the same mechanism. So the system becomes like a tree of nested virtual machines where parent processes are always in full control over their children.

Compared to iOS or Android, which are essentially "flat", Genode's recursive structure provides a much more flexible way to model security policies, for example by hosting critical system functions nearby the root of the tree, and subordinating a complex piece of untrusted code into a dedicated subsystem at an upper tree level.

This is the basic idea how the system looks like. The other interesting question is how it behaves and how processes interact with each other. To blatantly simplify it, processes can only interact with each other if their common parent process agrees.


Because in Genode, each process lives in its own world as shaped by its parent, it may never know whether if it interacts with a real device or a virtual one. It is for the parent to decide (and again, this parent may also not know if he is interacting with something physical or virtual). So Genode would make it very easy to let the user supply custom versions of a contact list or a virtual camera to an application.

Our concern for privacy is actually one of the driving motivations behind developing Genode.


Both actually. Genode's core can be executed on top of a variety of kernels, for example Linux, NOVA, OKL4, Fiasco.OC. There is a different version of core for each kernel. The role of core is to translate the respective kernel interface to a generic programming interface (the Genode API).

All processes upon core are using the Genode API only and are thereby independent from the kernel. So a device driver implemented using the Genode API can run on all kernels supported by Genode. When using Linux device driver code on Genode, we use to build glue code that translates the API used by driver to the Genode API. For example, to get the Linux USB stack running, we have created a small library that looks like the Linux kernel from the driver's perspective. In reality, it just maps all the used function calls to the Genode API.




I think this specific analogy is a bit complex to be expressive. It has too many roles (web server, web application, browser, web standard, PHP). In one way, the analogy is quite fitting. When using PHP you don't care too much about the web server. So you can move your website to another (e.g. faster) web server without needing to change the code. For Genode, it is similar. A program developed using the Genode API can be used on many kernel without changing the driver's code. But that particular trait is common for all kind of abstraction layers and not so much a unique point of Genode.




Wow! I would greatly appreciate that. Thanks for taking the time for investigating the project more deeply.

Reply Parent Score: 5