The Asterinas project has released version 0.18, a kernel written in Rust and designed for use in general-purpose operating systems. The kernel provides an ABI (Application Binary Interface) compatible with the kernel. Linux and can be used instead. The Asterinas NixOS distribution, which combines the Asterinas kernel with the NixOS system environment, is being developed in parallel. The project's code is distributed under the MPL (Mozilla Public License).
Currently, there are about 240 system calls implemented in the kernel. LinuxThe Asterinas NixOS distribution is verified to run on top of the Asterinas kernel with over 100 NixOS packages. Supported packages include: Xfce, Firefox, bash, systemd, Podman, QEMU, rsync, Apache httpd, nginx, SQLite, Redis, Clang, GCC, Go, Lua, Node.js, OpenJDK, Perl, PHP, Python, Ruby, Rust, Git, FFmpeg, PyTorch, TensorFlow, Ollama, and Codex.
The kernel provides full support for the x86-64 architecture, partial support for RISC-V 64 and x86-64 with isolation based on Intel TDX, as well as initial support for the LoongArch 64 architecture. Priority areas of application include systems based on Linux ABIs, but requiring a higher level of security. For example, Asterinas is proposed for use in creating a system environment for secure virtual machines, isolating them using technologies such as ARM CCA, AMD SEV, and Intel TDX, as well as on the host system side, enabling container launches.
To reduce the likelihood of memory errors, the main source of the most dangerous vulnerabilities, Asterinas uses the Rust language and a limited use of unsafe blocks. The kernel is built using the framekernel architecture, which attempts to combine the isolation capabilities of microkernels with the efficiency of monolithic kernels.
Kernel components in Asterinas are located in a shared address space, and security is achieved through logical separation of secure code from code that could potentially be vulnerable. The kernel is divided into two parts, both written in Rust: OS Framework and OS Services. OS Services prohibits the use of unsafe blocks, and all low-level operations that require code execution in unsafe blocks are moved to the OS Framework and accessible only through a high-level API. All system calls, file systems, and drivers are implemented at the OS Services level and cannot include unsafe blocks.
For developing system services and kernel modules, the OSDK (Operating System Development Kit) is provided, providing the cargo-osdk utility for creating, building, testing, and running operating system components. Developers can also use the OSTD (Operating System Standard Library) set, which includes an edition of the Rust standard libraries (crate std) adapted for use in operating system components.
Among the changes in version 0.18:
- As part of the work to ensure that Asterinas runs as a guest system in Kata Containers and Confidential Containers VM containers, support has been implemented for IPC and cgroup namespaces, nsfs (/proc/[pid]/ns), cgroups, virtio-fs (for accessing a file system shared with the host system), virtio-rng (/dev/hwrng for entropy for the pseudo-random number generator), and vsock (for communication between the host and guest systems).
- Implemented the ptrace system call and user-space debugging capabilities using GDB and strace.
- A new implementation of the ext2 file system has been proposed, and an NVMe driver has been added. A Dentry (Directory Entry) mechanism has been added to the VFS, and the page cache implementation has been redesigned.
- The Asterinas NixOS distribution has the ability to run Codex, QEMU, and Firefox.
- Added system calls pidfd_getfd, pidfd_send_signal, pivot_root.
- Added initial IPv6 support.
- A capabilities system has been implemented for delegating individual privileged operations.
- Added initial implementation of the LSM framework (Linux Security Modules).
Source: opennet.ru
