Microsoft has launched the first release of the Litebox project, which develops a security-focused operating system implemented as a Library OS. In this approach, the operating system services are directly embedded into the application instead of calling an external OS kernel via system calls. Litebox can be used in applications or kernels as an additional isolation layer, blocking access to unnecessary kernel functionality or APIs. The project code is written in Rust and is open under the MIT license.
Litebox provides an attachable library for applications with an isolating layer that translates requests to external interfaces. Such external interfaces can include the Linux kernel, the secure isolated environments of OP-TEE (Open Portable Trusted Execution Environment), WebAssembly environments, or the standard Rust library RustStd.
The minimal platform created through Litebox is applicable for running Linux and Windows applications, nested Linux kernels, and LVBS (Linux Virtualization Based Security). Potential use cases for Litebox include enabling unmodified Linux programs to run in Windows, isolating the execution of Linux applications on systems with a Linux kernel, launching programs on top of AMD SEV SNP for memory encryption, executing OP-TEE programs in Linux, and isolation using the LVBS concept (utilizing hardware virtualization to protect specific components of the Linux kernel, such as those used for module authenticity verification and access control).
Source: opennet.ru
