[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [MirageOS-devel] Mirage OS and Qubes OS integration

I haven't been doing much to it recently, except switching
dependencies to use upstream versions as they get released. The only
one still pinned to a Git commit is mirage-nat (which I think is
waiting for ICMP NAT support - I believe Mindy is currently
refactoring the tcpip library, which might allow sharing its ICMP
support with mirage-nat).

I've been running mirage-firewall fine for a couple of months now on
my laptop with 20 MB RAM allocated to it (the last known out-of-memory
bug was fixed 27th Feb).

I've just updated it today to support OCaml 4.03, which should bring
reproducible builds :-) (requires mirage-qubes >= 0.3).
For some reason, the binary size has increased from about 5 MB to
about 10 MB (and it no longer runs with 20 MB RAM). I'm not sure what
caused that - probably some extra dependency getting pulled in

On 13 May 2016 at 20:28, Cyril LEVIS <levis.cyril@xxxxxxxxx> wrote:
> Hi,
> What about mirage firewall integration? Leonard is working hard ^^
> https://github.com/talex5/mirage-qubes
> Le lundi 8 février 2016 16:24:04 UTC+1, Anil Madhavapeddy a écrit :
>> On 7 Feb 2016, at 22:33, Thomas Leonard <tal...@xxxxxxxxx> wrote:
>> >
>> >> How is that related to Mirage OS? It can be distributed/installed as
>> >> minimal root.img, containing just /boot directory with:
>> >> - a Mirage OS binary
>> >> - grub2 configuration starting it
>> >>
>> >> Why not installing it directly as a kernel (also using some new qrexec
>> >> service)? Two reasons:
>> >> - VM kernel loaded from dom0 filesystem is parsed by a toolstack
>> >>   running there. While the attack surface is quite small here
>> >>   (probably only uncompressing code), it still exists
>> This is indeed how we boot on EC2 at the moment (which uses pv-grub also).
>> https://github.com/mirage/mirage/blob/master/scripts/ec2.sh
>> A Mirage Xen unikernel is wrapped in a minimal image that includes a
>> grub.conf that points to it.
>> Anil

Dr Thomas Leonard        http://roscidus.com/blog/
GPG: DA98 25AE CAD0 8975 7CDA  BD8E 0713 3F96 CA74 D8BA

MirageOS-devel mailing list



Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.