Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Subgraph OS: Adversary resistant computing platform

subgraph.com

Post reply on HN
Print view View original

11–20 of 88 posts

Re: Subgraph OS: Adversary resistant computing platform

#11

Post by tptacek »

jcao219 wrote: post #10
xdma wrote: post #5

Earlier quoted context omitted.

Hi, I'm an SGOS dev. I don't know what you mean by "mostly a patched Linux", but here's what Subgraph OS is so far -- and it's a young project: we have a kernel patched with grsec/PaX/RAP, but we have also developed our own application sandbox framework (namespaces + limited fs + seccomp bpf whitelisting), app firewall, event monitoring subsystem, usb disable on desktop lock (based on grsec), etc. Here's a walkthroug…

Hi! Why did you choose the name Subgraph OS?

It's named for their company, which does other things too.

Re: Subgraph OS: Adversary resistant computing platform

#12

Post by xdma »

mtgx wrote: post #8
xdma wrote: post #5

Earlier quoted context omitted.

Hi, I'm an SGOS dev. I don't know what you mean by "mostly a patched Linux", but here's what Subgraph OS is so far -- and it's a young project: we have a kernel patched with grsec/PaX/RAP, but we have also developed our own application sandbox framework (namespaces + limited fs + seccomp bpf whitelisting), app firewall, event monitoring subsystem, usb disable on desktop lock (based on grsec), etc. Here's a walkthroug…

No updated iso since June. Any plans for an update soon? Also, shouldn't you just use Wayland for the stable 1.0 release? Why even bother with X11 at this point? Do you plan to support flatpaks as well?

The new ISO is coming very soon. We've just been busy with consulting we do to support the project and there were some issues with gpg2.

Wayland is one huge reason why we aren't even calling this "beta". Wayland is absolutely part of the plan. We are working on integration now.

Flatpaks: probably not. Different vision. Flatpak is an 'appstore' type model, not sure we will want that in Subgraph OS, but it's worth a deeper investigation than the thought I've given it so far. There are things in Flatpak that we can benefit from, such as the UI advantages of "Portals". We'll probably be adding support for it to Oz.

Re: Subgraph OS: Adversary resistant computing platform

#13

Post by mtgx »

jcoffland wrote: post #7
verandaguy wrote: post #2

"Adversary-resistant" is an extremely bold claim. While the architecture does look promising, and (at least intuitively) reasonably-designed, I think it's a bit too soon to make a call about adversary resistance.

The word "resistant" is qualitative so they are not really making a bold claim.

Yes, just like water-resistant vs water-proof. Subgraph OS is like hacking-resistant, not hacking-proof.

Re: Subgraph OS: Adversary resistant computing platform

#15

Post by protomikron »

This is a step in the right direction (in the sense that we should sandbox applications harder), but in my opinion we have to change fundamental aspects of our stack (e.g. Proprietary Firmware Linux GNU-System-Libs X GTK Evince), to gain more security.

In particular I think it is harmful that all applications share the same view on the FS and have in principal the possibility to use e.g. full unixoish capabilities. My bet is that the solution is via better type systems, e.g. an application that is a desktop game could have something like

  exec :: GameConfig -> WindowControl ()
where GameConfig is e.g. some CFG specific to the game and WindowControl is similar to IO () however limited to interacting with a drawing library (e.g. OpenGL) and input systems (keyboard and mouse local to the window).

At the moment every application just implements `main()` and is good to go and we separate between kernel- and user-space (and a VM on top e.g. Android and Apple), and maybe this is too coarse.

I think pledge (http://man.openbsd.org/pledge) is also a step in the right direction however I would prefer it to be the other way around: an application goes through a setup process where it gains the capabilities it needs (in pledge it's the other way around, you ask to drop them).

Re: Subgraph OS: Adversary resistant computing platform

#16

Post by xdma »

tptacek wrote: post #11
jcao219 wrote: post #10

Earlier quoted context omitted.

Hi! Why did you choose the name Subgraph OS?

It's named for their company, which does other things too.

Yup. Subgraph is a nearly 7 year old open source software company. We wrote a web scanner (Vega) that's sadly neglected, though still used regularly by thousands of users. We also do consulting, like pentesting, etc.

The name was inspired by work I was following at the time (10 years ago?) by Halvar Flake etc, on applying graph theory methods to reverse engineering / runtime analysis.

Re: Subgraph OS: Adversary resistant computing platform

#17

Post by formula1 »

Ill give it a shot. Ive been feeling quite vulnerable on 16.04 due to the absurd amount of unfixed bugs. I have a couple of questions

- its mentioned that it does not have access to documents and downloads within the user folder. When it wants/needs read access, how am I told?

- if it doesnt have access to these folders, does it only write to its own subset?

- is it possible to make my home downloads folder an aggregate of the application downloads?

- when uninstalling/purging, since its sandboxed it deletes all of the content or keeps it? Can I force removal as well?

- how does subgraph deal with shared services/folders/info? Can I share a service with another user? Can I share the network setting modifications with other users?

- how can I prevent an application from using the network without my knowledge?

- are the tools like nethogs/top for subgraph that can take advantage of the compartments to show a more realistic view of whats going on?

I think this has a lot of potential!

Re: Subgraph OS: Adversary resistant computing platform

#19

Post by xdma »

formula1 wrote: post #17

Ill give it a shot. Ive been feeling quite vulnerable on 16.04 due to the absurd amount of unfixed bugs. I have a couple of questions - its mentioned that it does not have access to documents and downloads within the user folder. When it wants/needs read access, how am I told? - if it doesnt have access to these folders, does it only write to its own subset? - is it possible to make my home downloads folder an aggreg…

These are great questions. We have a Gnome shell plug-in to move files into sandboxes while an application is running. Certain applications also have shared directories (e.g. "Downloads/TorBrowser", "Documents/LibreOffice"). This is a UX work in progress though, neither of these are adequate, though together they're workable.

re: Applications and network access: we have an application firewall, unique to Linux-based OSs. It's basically Little Snitch for Linux. There is a screenshot here:

Keep in mind that the project is very young. We are just getting started, tbh. With questions like these you should idle in our IRC channel where we talk about all of this stuff: OFTC/#subgraph.

Post reply on HN