Tomeu Vizoso
November 09, 2017
Reading time:
Last week I played a bit with crosvm, a KVM monitor used within Chromium OS for application isolation. My goal is to learn more about the current limits of virtualization for isolating applications in mainline. Two of crosvm's defining characteristics is that it's written in Rust for increased security, and that uses namespaces extensively to reduce the attack surface of the monitor itself.
It was quite easy to get it running outside Chromium OS (have been testing with Fedora 26), with the only complication being that minijail isn't widely packaged in distros. In the instructions below we hack around the issue with linker environment variables so we don't have to install it properly. Instructions are in form of shell commands for illustrative purposes only.
Build kernel:
$ cd ~/src $ git clone git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git $ cd linux $ git checkout v4.12 $ make x86_64_defconfig $ make bzImage $ cd ..
Build minijail:
$ git clone https://android.googlesource.com/platform/external/minijail $ cd minijail $ make $ cd ..
Build crosvm:
$ git clone https://chromium.googlesource.com/a/chromiumos/platform/crosvm $ cd crosvm $ LIBRARY_PATH=~/src/minijail cargo build
Generate rootfs:
$ cd ~/src/crosvm $ dd if=/dev/zero of=rootfs.ext4 bs=1K count=1M $ mkfs.ext4 rootfs.ext4 $ mkdir rootfs/ $ sudo mount rootfs.ext4 rootfs/ $ debootstrap testing rootfs/ $ sudo umount rootfs/
Run crosvm:
$ LD_LIBRARY_PATH=~/src/minijail ./target/debug/crosvm run -r rootfs.ext4 --seccomp-policy-dir=./seccomp/x86_64/ ~/src/linux/arch/x86/boot/compressed/vmlinux.bin
The work ahead includes figuring out the best way for Wayland clients in the guest interact with the compositor in the host, and also for guests to make efficient use of the GPU.
25/04/2024
While I managed to land support for two extensions, implementing control flow re-convergence in NVK did not go as planned. This is the story…
14/03/2024
In continuation with our series about Kernel Integration we'll go into more detail about how regression detection, processing, and tracking…
21/02/2024
Now included in our Debian images & available via our GitLab, you can build a complete, working BL31 (Boot Loader stage 3.1), and replace…
19/02/2024
Back in 2022, after a series of issues were found in its design, I made the call to rework some of WirePlumber's fundamentals in order to…
08/02/2024
Continuing our Kernel Integration series, we're excited to introduce DRM-CI, a groundbreaking solution that enables developers to test their…
23/01/2024
This is the fourth and final part in a series on persian-rug, a Rust crate for interconnected objects. We've touched on the two big limitations:…
Comments (3)
Jun Sun:
Sep 27, 2019 at 09:55 PM
When I tried to build crosvm, I got the following error. Any ideas?
Caused by:
failed to load source for a dependency on `audio_streams`
Reply to this comment
Reply to this comment
junyu:
Mar 04, 2021 at 07:23 PM
yes,i got a same ERR...How can I fix it?
Reply to this comment
Reply to this comment
Tomeu Vizoso:
Mar 05, 2021 at 05:39 AM
Changes in Crosvm have introduced new dependencies. I would recommend nowadays to base on this Dockerfile when building Crosvm: https://gitlab.freedesktop.org/virgl/virglrenderer/-/blob/master/perf-testing/Docker/Dockerfile.
More instructions here: https://gitlab.freedesktop.org/virgl/virglrenderer/-/blob/master/perf-testing/README.md
Reply to this comment
Reply to this comment
Add a Comment