README 5.4 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143
  1. Graphene Library OS
  2. A Linux-compatible Library OS for Multi-Process Applications
  3. 1. WHAT IS GRAPHENE?
  4. Graphene Library OS is a project to provided lightweight guest OSes with
  5. support for Linux multi-process applications. Comparable to virtual
  6. machines, Graphene can run applications in an isolated environment, with
  7. virtualization benefits such as guest customization, platform independence
  8. and migration.
  9. Graphene Library OS is a work published in Eurosys 2014. For more
  10. information. see the paper: Tsai, et al, "Cooperation and Security Isolation
  11. of Library OSes for Multi-Process Applications", Eurosys 2014.
  12. 2. HOW TO BUILD GRAPHENE?
  13. Graphene Library OS is consist of five parts:
  14. - Instrumented GNU Library C
  15. - LibOS (a shared library named "libsysdb.so")
  16. - PAL, a.k.a Platform Adaption Layer (a shared library named "libpal.so")
  17. - Reference monitor (a shared library named "libpal_sec.so")
  18. - Minor kernel customization and kernel modules
  19. Graphene Library OS currently only works on x86_64 architecture.
  20. Graphene Library OS is tested to be compiling and running on Ubuntu 12.04/14.04
  21. (both server and desktop version), along with Linux kernel 3.5/3.14.
  22. We recommand to build and install Graphene with the same host platform.
  23. Other distributions of 64-bit Linux can potentially, but the result is not
  24. guaranteed. If you find Graphene not working on other distributions, please
  25. contact us with a detailed bug report.
  26. The following packages are required for building Graphene: (can be installed
  27. with 'apt-get install')
  28. - build-essential
  29. - autoconf
  30. - gawk
  31. To build the system, simply run the following commands in the root of the
  32. source tree:
  33. make
  34. make install
  35. (Add Graphene kernel as a boot option by commands like "update-grub")
  36. (reboot and choose the Graphene kernel)
  37. Please note that the building process may pause before building the Linux
  38. kernel, because it requires you to provide a sensible configuration file
  39. (.config). The Graphene kernel requires the following options to be enabled
  40. in the configuration:
  41. - CONFIG_GRAPHENE=y
  42. - CONFIG_GRAPHENE_BULK_IPC=y
  43. - CONFIG_GRAPHENE_ISOLATE=y
  44. Each part of Graphene can be built separately in the subdirectories.
  45. To build Graphene library OS with debug symbol, run "make debug" instead of
  46. "make".
  47. For more details about the building and installation, see the Graphene github
  48. Wiki page: <https://github.com/oscarlab/graphene/wiki>.
  49. 3. HOW TO RUN AN APPLICATION IN GRAPHENE?
  50. Graphene library OS uses PAL (libpal.so) as a loader to bootstrap an
  51. application in the library OS. To start Graphene, PAL (libpal.so) will have
  52. to be run as an executable, with the name of the program, and a "manifest
  53. file" given from the command line. Graphene provides three options for
  54. spcifying the programs and manifest files:
  55. option 1: (automatic manifest)
  56. [PATH TO Pal/src]/pal [PROGRAM] [ARGUMENTS]...
  57. (Manifest file: "[PROGRAM].manifest" or "manifest")
  58. option 2: (given manifest)
  59. [PATH TO Pal/src]/pal [MANIFEST] [ARGUMENTS]...
  60. option 3: (manifest as a script)
  61. [PATH TO MANIFEST]/[MANIFEST] [ARGUMENTS]...
  62. (Manifest must have "#![PATH_TO_PAL]/libpal.so" as the first line)
  63. Using "libpal.so" as loader to start Graphene will not attach the applications
  64. to the Graphene reference monitor. Tha applications will have better
  65. performance, but no strong security isolation. To attach the applications to
  66. the Graphene reference monitor, Graphene must be started with the PAL
  67. reference monitor loader (libpal_sec.so). Graphene provides three options for
  68. spcifying the programs and manifest files to the loader:
  69. option 4: (automatic manifest - with reference monitor)
  70. [PATH TO Pal/src]/pal_sec [PROGRAM] [ARGUMENTS]...
  71. (Manifest file: "[PROGRAM].manifest" or "manifest")
  72. option 5: (given manifest - with reference monitor)
  73. [PATH TO Pal/src]/pal_sec [MANIFEST] [ARGUMENTS]...
  74. option 6: (manifest as a script - with reference monitor)
  75. [PATH TO MANIFEST]/[MANIFEST] [ARGUMENTS]...
  76. (Manifest must have "#![PATH TO Pal/src]/pal_sec" as the first line)
  77. Although manifest files are optional for Graphene, running an application
  78. usually requires some minimal configuration in its manifest file. A
  79. sensible manifest file will include paths to the library OS and GNU
  80. library C, environment variables such as LD_LIBRARY_PATH, file systems to
  81. be mounted, and isolation rules to be enforced in the reference monitor.
  82. Here is an example of manifest files:
  83. loader.preload = file:LibOS/shim/src/libsysdb.so
  84. loader.env.LDL_LIBRAY_PATH = /lib
  85. fs.mount.root.type = chroot
  86. fs.mount.root.uri = file:/
  87. fs.mount.other.glibc.type = chroot
  88. fs.mount.other.glibc.path = /lib
  89. fs.mount.other.glibc.uri = file:LibOS/build
  90. More examples can be found in the test directories (LibOS/shim/test). We have
  91. also tested several commercial applications such as GCC, Bash and Apache,
  92. and the manifest files that bootstrap them in Graphene are provided in the
  93. individual directories.
  94. For more information and the detail of the manifest syntax, see the Graphene
  95. github Wiki page: <https://github.com/oscarlab/graphene/wiki>.
  96. 4. HOW TO CONTACT THE MAINTAINER?
  97. For any questions or bug reports, please contact us:
  98. Chia-Che Tsai <chitsai@cs.stonybrook.edu>
  99. Donald Porter <porter@cs.stonybrook.edu>
  100. or post an issue on our github repository:
  101. <https://github.com/oscarlab/graphene/issues>