chrome os internals
play

Chrome OS Internals Josh Triplett josh@joshtriplett.org LinuxCon - PowerPoint PPT Presentation

Chrome OS Internals Josh Triplett josh@joshtriplett.org LinuxCon Europe 2014 Josh Triplett Chrome OS Internals LinuxCon Europe 2014 1 / 43 Overview Intro to Chrome OS Architecture of Chrome OS Verified boot and developer mode Security


  1. Chrome OS userspace Linux distribution Based on Gentoo -O99 -funroll-loops -fomit-instructions -ftw Uses the Portage build system and packaging infrastructure Pulls in many packages from Gentoo, and adds patches Adds its own chromiumos-overlay with the Chrome OS core and additional packages Adds board-specific overlay for each target board Josh Triplett Chrome OS Internals LinuxCon Europe 2014 14 / 43

  2. Chrome OS userspace Linux distribution Based on Gentoo -O99 -funroll-loops -fomit-instructions -ftw Uses the Portage build system and packaging infrastructure Pulls in many packages from Gentoo, and adds patches Adds its own chromiumos-overlay with the Chrome OS core and additional packages Adds board-specific overlay for each target board Notable divergence from Gentoo: Upstart Josh Triplett Chrome OS Internals LinuxCon Europe 2014 14 / 43

  3. Chrome OS userspace stack Upstart and system daemons X Window System (for now) Mesa, libdrm, etc. Forks of ConnMan and ModemManager Custom audio server, cras Chrome browser, running Aura window manager Chrome browser windows Josh Triplett Chrome OS Internals LinuxCon Europe 2014 15 / 43

  4. Chrome OS UI “Aura” Traditional window management Panel with fast-access app icons and app menu System tray, clock, notifications Designed with the Chrome OS keyboard in mind Runs in Chrome itself Josh Triplett Chrome OS Internals LinuxCon Europe 2014 16 / 43

  5. Chrome OS UI “Aura” Traditional window management Panel with fast-access app icons and app menu System tray, clock, notifications Designed with the Chrome OS keyboard in mind Runs in Chrome itself X, Ozone, Freon Josh Triplett Chrome OS Internals LinuxCon Europe 2014 16 / 43

  6. Chrome OS graphics Chrome GPU sandbox links to Mesa Runs on X or GBM Talks to graphics hardware /dev/dri/card0 GPU sandbox provides virtual GLES contexts Validated Isolated Browser engine, WebGL, and NaCl each get a GLES context Communicate with GPU sandbox via command buffer Josh Triplett Chrome OS Internals LinuxCon Europe 2014 17 / 43

  7. Chrome browser Almost all system components exist to support the browser Shares significant code with Chrome for Linux, but separate target Many different sandboxes Supports HTML5 and JavaScript with additional APIs Supports applications and extensions written in JavaScript https://developer.chrome.com/apps/api_index https://developer.chrome.com/extensions/api_index Supports native code via Native Client (NaCl) https://developer.chrome.com/native-client/pepper_dev/c Can port code from other platforms Josh Triplett Chrome OS Internals LinuxCon Europe 2014 18 / 43

  8. Chrome Web Store Chrome OS’s “app store” Most apps run on Chrome for Windows, Linux, or Chrome OS Apps runnable via system menu Apps and app data synced between Chrome browsers App format: .crx , a modified .zip Same package used for all platforms Prepended header includes signature via RSA and SHA-1 For more information: https://developer.chrome.com/extensions/crx Josh Triplett Chrome OS Internals LinuxCon Europe 2014 19 / 43

  9. Native Client Sandboxed native code execution Uses seccomp BPF Based on Linux ELF file format C toolchain based on GCC and newlib or glibc Support for non-C languages Extensive Chrome-specific API Completely event driven; main thread may not block Ports of numerous major POSIX libraries Josh Triplett Chrome OS Internals LinuxCon Europe 2014 20 / 43

  10. Security Josh Triplett Chrome OS Internals LinuxCon Europe 2014 21 / 43

  11. Chrome OS threat model root � = kernel Enable local developers Protect against malware, especially persistent malware Protect against theft Slow down local attacks Defense in depth Josh Triplett Chrome OS Internals LinuxCon Europe 2014 22 / 43

  12. Chrome OS security Extensive kernel and userspace hardening Josh Triplett Chrome OS Internals LinuxCon Europe 2014 23 / 43

  13. Chrome OS security Extensive kernel and userspace hardening Verified boot, developer mode, and stateful wipe Josh Triplett Chrome OS Internals LinuxCon Europe 2014 23 / 43

  14. Chrome OS security Extensive kernel and userspace hardening Verified boot, developer mode, and stateful wipe Per-user and per-system encrypted partitions (uses TPM, eCryptFS) Josh Triplett Chrome OS Internals LinuxCon Europe 2014 23 / 43

  15. Chrome OS security Extensive kernel and userspace hardening Verified boot, developer mode, and stateful wipe Per-user and per-system encrypted partitions (uses TPM, eCryptFS) namespaces Josh Triplett Chrome OS Internals LinuxCon Europe 2014 23 / 43

  16. Chrome OS security Extensive kernel and userspace hardening Verified boot, developer mode, and stateful wipe Per-user and per-system encrypted partitions (uses TPM, eCryptFS) namespaces seccomp Josh Triplett Chrome OS Internals LinuxCon Europe 2014 23 / 43

  17. Chrome OS security Extensive kernel and userspace hardening Verified boot, developer mode, and stateful wipe Per-user and per-system encrypted partitions (uses TPM, eCryptFS) namespaces seccomp Most daemons run via “minijail” Josh Triplett Chrome OS Internals LinuxCon Europe 2014 23 / 43

  18. Chrome OS security Extensive kernel and userspace hardening Verified boot, developer mode, and stateful wipe Per-user and per-system encrypted partitions (uses TPM, eCryptFS) namespaces seccomp Most daemons run via “minijail” No installable OS components or packages Only changes via Chrome OS updates Browser sandboxed Josh Triplett Chrome OS Internals LinuxCon Europe 2014 23 / 43

  19. Additional hardening measures ASLR, user and kernel Hiding kernel pointers Josh Triplett Chrome OS Internals LinuxCon Europe 2014 24 / 43

  20. Additional hardening measures ASLR, user and kernel Hiding kernel pointers Compiler hardening, including stack protection glibc checks Josh Triplett Chrome OS Internals LinuxCon Europe 2014 24 / 43

  21. Additional hardening measures ASLR, user and kernel Hiding kernel pointers Compiler hardening, including stack protection glibc checks Restricted kernel-module loading Josh Triplett Chrome OS Internals LinuxCon Europe 2014 24 / 43

  22. Additional hardening measures ASLR, user and kernel Hiding kernel pointers Compiler hardening, including stack protection glibc checks Restricted kernel-module loading Restricted device permissions and capabilities Josh Triplett Chrome OS Internals LinuxCon Europe 2014 24 / 43

  23. Additional hardening measures ASLR, user and kernel Hiding kernel pointers Compiler hardening, including stack protection glibc checks Restricted kernel-module loading Restricted device permissions and capabilities Compiled out unnecessary security-sensitive components Josh Triplett Chrome OS Internals LinuxCon Europe 2014 24 / 43

  24. Security policy With a normal Chrome OS image, and developer mode off, it should not be possible to run any user-supplied native Linux executable or script. Josh Triplett Chrome OS Internals LinuxCon Europe 2014 25 / 43

  25. User separation Chrome OS supports multiple users, and a “guest” Users tied to Google accounts Accounts theoretically identical across devices Each account has its own data, apps, etc Josh Triplett Chrome OS Internals LinuxCon Europe 2014 26 / 43

  26. User separation Chrome OS supports multiple users, and a “guest” Users tied to Google accounts Accounts theoretically identical across devices Each account has its own data, apps, etc Accounts share networking and other system resources Results in some confusing issues: need network to log in, and want to share networks among users, but cannot allow users to control the network used to log in. Josh Triplett Chrome OS Internals LinuxCon Europe 2014 26 / 43

  27. Chrome browser security JavaScript sandboxing Josh Triplett Chrome OS Internals LinuxCon Europe 2014 27 / 43

  28. Chrome browser security JavaScript sandboxing Native Client sandboxing Code verification and analysis Effectively native speed Josh Triplett Chrome OS Internals LinuxCon Europe 2014 27 / 43

  29. Chrome browser security JavaScript sandboxing Native Client sandboxing Code verification and analysis Effectively native speed Tabs in separate, locked-down processes Media decoding and graphics in separate, locked-down processes Josh Triplett Chrome OS Internals LinuxCon Europe 2014 27 / 43

  30. Chrome browser security JavaScript sandboxing Native Client sandboxing Code verification and analysis Effectively native speed Tabs in separate, locked-down processes Media decoding and graphics in separate, locked-down processes Sandboxed processes use seccomp BPF for syscall filtering Josh Triplett Chrome OS Internals LinuxCon Europe 2014 27 / 43

  31. Chrome browser security JavaScript sandboxing Native Client sandboxing Code verification and analysis Effectively native speed Tabs in separate, locked-down processes Media decoding and graphics in separate, locked-down processes Sandboxed processes use seccomp BPF for syscall filtering Many features used opportunistically on Linux exist unconditionally on Chrome OS Josh Triplett Chrome OS Internals LinuxCon Europe 2014 27 / 43

  32. Building Josh Triplett Chrome OS Internals LinuxCon Europe 2014 28 / 43

  33. Getting Chrome OS Source Most of Chrome OS is tracked via git Josh Triplett Chrome OS Internals LinuxCon Europe 2014 29 / 43

  34. Getting Chrome OS Source Most of Chrome OS is tracked via git A whole lot of git Hundreds of repositories Specific directory layout Josh Triplett Chrome OS Internals LinuxCon Europe 2014 29 / 43

  35. Getting Chrome OS Source Most of Chrome OS is tracked via git A whole lot of git Hundreds of repositories Specific directory layout repo Josh Triplett Chrome OS Internals LinuxCon Europe 2014 29 / 43

  36. Getting Chrome OS Source Most of Chrome OS is tracked via git A whole lot of git Hundreds of repositories Specific directory layout repo repo init -u $manifest url repo sync Josh Triplett Chrome OS Internals LinuxCon Europe 2014 29 / 43

  37. Getting Chrome OS Source Most of Chrome OS is tracked via git A whole lot of git Hundreds of repositories Specific directory layout repo repo init -u $manifest url repo sync repo start repo upload Josh Triplett Chrome OS Internals LinuxCon Europe 2014 29 / 43

  38. Bootstrapping via chroot Self-hosted build environment Avoids reliance on host tools and distribution Josh Triplett Chrome OS Internals LinuxCon Europe 2014 30 / 43

  39. Bootstrapping via chroot Self-hosted build environment Avoids reliance on host tools and distribution depot_tools Josh Triplett Chrome OS Internals LinuxCon Europe 2014 30 / 43

  40. Bootstrapping via chroot Self-hosted build environment Avoids reliance on host tools and distribution depot_tools cros_sdk Josh Triplett Chrome OS Internals LinuxCon Europe 2014 30 / 43

  41. Bootstrapping via chroot Self-hosted build environment Avoids reliance on host tools and distribution depot_tools cros_sdk Downloads initial binary chroot Can rebuild from source Josh Triplett Chrome OS Internals LinuxCon Europe 2014 30 / 43

  42. Bootstrapping via chroot Self-hosted build environment Avoids reliance on host tools and distribution depot_tools cros_sdk Downloads initial binary chroot Can rebuild from source namespaces Josh Triplett Chrome OS Internals LinuxCon Europe 2014 30 / 43

  43. Bootstrapping via chroot Self-hosted build environment Avoids reliance on host tools and distribution depot_tools cros_sdk Downloads initial binary chroot Can rebuild from source namespaces Can run shell in chroot or act as command prefix cros_sdk --nousepkg -- build_command Mounts source tree as $HOME/trunk in chroot Josh Triplett Chrome OS Internals LinuxCon Europe 2014 30 / 43

  44. setup_board Set up build environment for each new target board Hardware codenames as mentioned earlier Generic target boards: amd64-generic, x86-generic Based on overlays in src/overlays Josh Triplett Chrome OS Internals LinuxCon Europe 2014 31 / 43

  45. setup_board Set up build environment for each new target board Hardware codenames as mentioned earlier Generic target boards: amd64-generic, x86-generic Based on overlays in src/overlays cros_sdk --nousepkg -- ./setup_board --board=$BOARD Josh Triplett Chrome OS Internals LinuxCon Europe 2014 31 / 43

  46. build_packages Build Gentoo packages from source Save the resulting binary packages Josh Triplett Chrome OS Internals LinuxCon Europe 2014 32 / 43

  47. build_packages Build Gentoo packages from source Save the resulting binary packages cros_sdk --nousepkg -- \ ./build_packages --board=$BOARD --nousepkg Josh Triplett Chrome OS Internals LinuxCon Europe 2014 32 / 43

  48. build_image Create root filesystem Install compiled binary packages onto it Construct disk image Josh Triplett Chrome OS Internals LinuxCon Europe 2014 33 / 43

  49. build_image Create root filesystem Install compiled binary packages onto it Construct disk image cros_sdk --nousepkg -- \ ./build_image --board=$BOARD \ --noenable_rootfs_verification dev Josh Triplett Chrome OS Internals LinuxCon Europe 2014 33 / 43

  50. build_image Create root filesystem Install compiled binary packages onto it Construct disk image cros_sdk --nousepkg -- \ ./build_image --board=$BOARD \ --noenable_rootfs_verification dev base, dev, test Josh Triplett Chrome OS Internals LinuxCon Europe 2014 33 / 43

  51. build_image Create root filesystem Install compiled binary packages onto it Construct disk image cros_sdk --nousepkg -- \ ./build_image --board=$BOARD \ --noenable_rootfs_verification dev base, dev, test Based on metapackages in src/third_party/chromiumos-overlay/chromeos-base Josh Triplett Chrome OS Internals LinuxCon Europe 2014 33 / 43

  52. rootfs verification Linux verifies root filesystem with dm-verity Mounting root read-write will break the hash Josh Triplett Chrome OS Internals LinuxCon Europe 2014 34 / 43

  53. rootfs verification Linux verifies root filesystem with dm-verity Mounting root read-write will break the hash ext4 feature flags Josh Triplett Chrome OS Internals LinuxCon Europe 2014 34 / 43

  54. rootfs verification Linux verifies root filesystem with dm-verity Mounting root read-write will break the hash ext4 feature flags Disable at build time with --noenable_rootfs_verification Josh Triplett Chrome OS Internals LinuxCon Europe 2014 34 / 43

  55. rootfs verification Linux verifies root filesystem with dm-verity Mounting root read-write will break the hash ext4 feature flags Disable at build time with --noenable_rootfs_verification Disable on existing image with /usr/share/vboot/bin/make_dev_ssh.sh --remove_rootfs_verification Josh Triplett Chrome OS Internals LinuxCon Europe 2014 34 / 43

  56. Image format GPT with 12 partitions “Stateful” read-write partition (expands to disk size) Linux kernel with header (A, B, and C) Root filesystem (A, B, and C) OEM three reserved EFI System Partition Bootable via coreboot/depthcharge, MBR (syslinux), and EFI (grub2) Josh Triplett Chrome OS Internals LinuxCon Europe 2014 35 / 43

  57. Booting ./image_to_usb.sh ./image_to_vm.sh Josh Triplett Chrome OS Internals LinuxCon Europe 2014 36 / 43

  58. Developing Josh Triplett Chrome OS Internals LinuxCon Europe 2014 37 / 43

  59. Chrome OS development Uses repo to manage several hundred git repositories Josh Triplett Chrome OS Internals LinuxCon Europe 2014 38 / 43

  60. Chrome OS development Uses repo to manage several hundred git repositories repo start, repo upload Josh Triplett Chrome OS Internals LinuxCon Europe 2014 38 / 43

  61. Chrome OS development Uses repo to manage several hundred git repositories repo start, repo upload Uses gerrit to accept and review contributions Josh Triplett Chrome OS Internals LinuxCon Europe 2014 38 / 43

  62. Chrome OS development Uses repo to manage several hundred git repositories repo start, repo upload Uses gerrit to accept and review contributions All changes require code review before merging Josh Triplett Chrome OS Internals LinuxCon Europe 2014 38 / 43

  63. Chrome OS development Uses repo to manage several hundred git repositories repo start, repo upload Uses gerrit to accept and review contributions All changes require code review before merging Changes built and tested on numerous Chrome OS platforms before merging Continous integration via buildbot Josh Triplett Chrome OS Internals LinuxCon Europe 2014 38 / 43

  64. Developing the Chrome browser Download source separately Josh Triplett Chrome OS Internals LinuxCon Europe 2014 39 / 43

  65. Developing the Chrome browser Download source separately Similar multi-repository structure Uses gclient in place of repo Uses reitveld in place of gerrit (Both support subversion in addition to git) Josh Triplett Chrome OS Internals LinuxCon Europe 2014 39 / 43

  66. Developing the Chrome browser Download source separately Similar multi-repository structure Uses gclient in place of repo Uses reitveld in place of gerrit (Both support subversion in addition to git) chromeos-base/chromeos-chrome Josh Triplett Chrome OS Internals LinuxCon Europe 2014 39 / 43

  67. Developing the Chrome browser Download source separately Similar multi-repository structure Uses gclient in place of repo Uses reitveld in place of gerrit (Both support subversion in addition to git) chromeos-base/chromeos-chrome CHROME_ORIGIN=LOCAL_SOURCE Josh Triplett Chrome OS Internals LinuxCon Europe 2014 39 / 43

  68. Modifying packages ebuild src/third_party/chromiumos-overlay Josh Triplett Chrome OS Internals LinuxCon Europe 2014 40 / 43

Download Presentation
Download Policy: The content available on the website is offered to you 'AS IS' for your personal information and use only. It cannot be commercialized, licensed, or distributed on other websites without prior consent from the author. To download a presentation, simply click this link. If you encounter any difficulties during the download process, it's possible that the publisher has removed the file from their server.

Recommend


More recommend