Linked by Thom Holwerda on Wed 6th Feb 2013 12:29 UTC, submitted by Anonymous
Gnome "Some GNOME developers are planning to implement an app format that allows developers to provide their Linux programs in distribution-independent files that can be installed as easily as smartphone apps. A sandbox model is supposed to isolate the apps from each other, and from the rest of the system, in a way that goes further than the isolation in current Linux distributions. Various developers worked to conceptualise such "Linux apps" at the GNOME Developer Experience Hackfest, which was held in the run-up to FOSDEM 2013 in Brussels. At the hackfest, the GNOME developers also declared JavaScript as the de-facto standard for GNOME programming." Right, because they haven't alienated enough of their users.
Permalink for comment 551766
To read all comments associated with this story, please click here.
RE[5]: Good in principal
by Neolander on Thu 7th Feb 2013 06:06 UTC in reply to "RE[4]: Good in principal"
Neolander
Member since:
2010-03-08

While I love the idea of a Microkernel (and trust me, I do), you can accomplish sandboxing without it.

I'm admittedly not well versed eough on the subject though.

You can sandbox user space apps without them, but the goal of microkernels is to also sandbox device drivers and the OS itself, so as to reduce the trusted computing base for a given task.

Considering how easily a buggy kernel-space driver can crash/lockup the whole OS or worse (I should know, I periodically experience that with GPU drivers and a USB piezo motor controller which we use at work), that's a Good Thing.

And this is why almost all OSs which initially went all monolithic are trying to push stuff back to user space nowadays. See WDDM drivers on Windows or FUSE on Linux as an example. I doubt that they will ever manage a full transition though, there's just too much work to do on a full-grown OS.

EDIT: As a bonus, microkernel also provide "natural" design guidelines for user app sandboxing. You can start by having security permissions that follow system component boundaries such as "Can use system components X, Y and Z", which are essentially free to implement. Then, you iterate from there towards finer-grained and coarser-grained mechanisms where needed. With monolithic architectures, on the other hand you are generally forced to derive and implement your sandboxing rules from the vacuum.

Edited 2013-02-07 06:24 UTC

Reply Parent Score: 4