Sandboxing a Linux process usually means spending a lot of effort deciding what it isn’t allowed to see. You might put it in a mount namespace, bind-mount a few directories into place, hide some others, add a chroot, and generally construct a carefully restricted version of the filesystem. But a new Linux kernel feature is about to change all of that. Instead of carefully hiding most of the filesystem, why not just take the filesystem away?
That’s essentially the idea behind FailFS, a tiny pseudo-filesystem expected to land in Linux 7.3. As the name suggests, it doesn’t do very much. In fact, that’s the point: every operation that reaches FailFS returns EOPNOTSUPP, meaning “operation not supported.”
The interesting bit is what happens when a process uses FailFS as its root or current working directory. At that point, normal pathname lookup essentially ceases to work. Absolute paths fail. Absolute symbolic links fail. Relative paths using the normal current-directory mechanism fail. If the application tries to open /etc/passwd, there simply isn’t a useful /etc to find.
Instead, the process has to start filesystem operations from an explicit file descriptor it already owns. For example, a sandbox manager could open a directory, hand that descriptor to the application, and the application could access files below it using calls such as openat(). Anything not reachable from one of those deliberately supplied descriptors might as well not exist.
Instead of starting with an entire filesystem and constructing rules that say, “not that, not that, not that,” you start with nothing and explicitly hand over the pieces the program needs.
There are some interesting consequences. At present, putting a process completely inside FailFS also prevents it from launching ordinary dynamically linked executables. ELF binaries generally specify their dynamic loader using an absolute pathname such as /lib64/ld-linux-x86-64.so.2. Absolute paths don’t work, so neither does the loader.
FailFS also has an interesting sibling called NULLFS, introduced earlier. NULLFS is another deliberately useless filesystem, but it behaves slightly differently: it contains a permanently empty directory and failed lookups return ENOENT, as though the requested file simply doesn’t exist. It was originally introduced to provide an immutable bottom layer beneath the real root filesystem and make operations such as pivot_root() cleaner.
Neither replaces all the other pieces needed for a secure sandbox. Processes still have system calls, networking, IPC, inherited descriptors, and plenty of other ways to cause trouble. But for controlling filesystem access, FailFS has a nice, simple philosophy.
Of course, if your file system is unwritable, that works, too.
Ah, so the Linus finally discovered what microkernels had in one form or another since 1980s. If he spent more time reading books instead of writing code, maybe the Linux Kernel wouldn’t become a bloated abomination it is nowdays.
+1
correct!
++1, just because it’s open source doesn’t mean the design is the best.
Probably too busy writing the kernel that would become the backbone of the entire modern technology landscape and global telecommunications network that you’re posting on right now.
What have you made/done that anyone would know about?
Hi, I don’t see how getting personal is any relevant or helpful. 🤷♂️
Anyhow, I’m just one of many strangers wandering on the vast internet.
I just meant to state that the author of the Linux kernal was a young student who fumbled together a kernal at the time.
And if I remember understanding it correctly, he even admitted this himself and described it as a hobby project, which I think was honest.
His project soon found many helpers or supporters or admirers who wrote device drivers for it,
thus building a foundation for the platform.
Even the kernal development itself had been assisted by contributors from early on.
So I’m not sure if most of the credits deserve to be associated to a single man.
Then in the following years (90s) a hype or cult or sort of sect about Linux and its creator emerged on the internet.
Not unlike how it happened later in the Mac camp in the 2000s..
In the 90s and early 2000s, using Linux was portrayed like joining a resistance force against (evil) MS/Windows.
It was about good vs bad, basically. As in Star Wars, if we like.
And the author was like the Luke Skywalker or John Connor of the IT (slightly exaggerated comparison maybe).
– Or so it seemed. I understandably have no or little idea how it was being perceived on a global scale, of course.
So please keep that in mind when reading these lines.
We already saw that type of conflict with Amiga vs PC in late 80s and early 90s,
but at the time that was about platforms only. There was no personal cult yet.
Linux also overshadowed Open Source and Free Software as such, using them to its own advantage.
According to my memory, there were few times that Linux didn’t came up in same sentence when those were originally intended to be mentioned individually.
Such as Open Office or Gimp, to name two examples.
And I speculate that this fame maybe also got into the author’s head,
and in parts leading to harsh and vulgar communications of the time.
Which in turn can cloud someones mind and judgement,
which is especially bad for a leader figure that relies on honest feedback and some healthy backlashes from time to time.
Which I think do matter for objectivity and code quality.
And back in tbe 90s, I think, issues of the shortcomings of early Linux systems/distros weren’t nearly as thoroughly being adressed in articles,
compared to pointing out the flaws of Windows, I think.
The trade press and the computer geeks often sided with Linux, that sympathic underdog.
In retrospect, I think, feedback was not nearly as unforgiving honest as it should have been.
In mainstream media of the time, Linux was more seem as a harmless curiosity used by eccentric computer fans than the uprising, dominating force it came to be.
(The only heavy criticism I personally remember came from die-hard Windows gamers and office users who were frustrated with using Linux distros.
Ordinary people kept giving Linux a chance over and over again.
But that’s just my observation, it might not be representative at all.)
All in all, these are thibgs which I assume normally should been a wake up call for anyone with critical thinking.
At this point, people should keep going to ask critical questions and and try to draw their own conclusions.
Especially if it’s something seemingly unregulated, unproven, uncertified piece of technology of a questionable origin.
And when the factor of liability is uncertain, too.
Because on the internet, things are not always what they may seem.
It’s a place of hoaxes, malware and people using fake IDs.
And despite being open source, the sheer complexity of Linux made and makes it difficult for checking for backdoors and bugs.
So it should never be truely trusted blindly just because it’s popular.
A certain sense of caution should should remain.
And in addition, I may add, both pros/cons should always beeing part of any meamingful disussion, with emotions being valid, but secondary.
Which is easier said than done, of course. We all have certain aversions, I guess. I’m no exception, obviously.
(By comparison, I think that the talk about other alternative OSes
such as BSD or BeOS was much quieter, less emotional back in the 90s or early 2000s.)
That being said, generall speaking, later additions to an OS kernal or any other type of software can’t really compensate for a flawed foundation or an architectural design flaw.
Such as an monolithic kernal form itself, which as such had been criticised multiple times.
Sorry for this reply being so long, I tried to put my thoughts into words.
My English isn’t the best, either, making it hard to read.
You used about 100x the words needed. You could just have shouted FUD FUD FUD.
Linux (the kernel) and many distros are supported by very big companies AND are the base for the biggest infrastructure providers: AWS, CloudFlare etc. This has been true since the Dotcom boom.
Yeah, I guess you’re right. 😅 It was way too long. Sorry about that. 😟
I didn’t mean to sound unfriendly to user Jake here, btw.
I wasn’t criticising him, I was thinking about the statements only.
Because it was. Not only that, but to continue with the comparison, this resistance didn’t force anyone to join: use it as you like, or don’t as you please. Come as you are, leave when you want (so, not really cult-like). The only absolute was and still is that the kernel is covered by the GPL. If you want to extend it, you can do whatever you want and and can keep it to yourself but you can’t distribute the result without honoring the terms that gave you the starting point in the first place. A LOT of people found that an acceptable, and even attractive, bargain. If enough people had been dissatisfied with Linux, they could have forked and continued as they pleased (I recall the occasional movements to do so, but don’t recall any gathering significant contributors to even be called also-rans). Those who didn’t want to work in that environment were free to use whatever other environment they pleased. BSD never went away after all and there were always the commercial alternatives (Windows, MacOS, “real” UNIX vendors to name a few).
You don’t have to write an entire kernel to be allowed to criticize some of the choices made in the linux kernel. That’s a ridiculous position.
No, you actually have to have at least a little bit of knowledge what the kernel is and not be stuck on some obsolete classification that is supposed to be better. His knowledge is massively obsolete, based on information 25 years old, micro kernels are not better and history has shown that not one OS that uses them has become mainstream, this while the Linux kernel is highly modular, can be adapted to any super large super computer and the smallest wifi router with tiny tiny resources, it is only bloated to somebody that still lives in the 1980 in their mind and thinks 1 kilobyte is a lot of memory LOL It shows that this guy just has no real IT experience in the real world.
Asks a stranger online another stranger.
Anyway, wide usage is not neccessarily a denominator of “good” but instead of “convenient enough” .
In the defense of the author, the author was just a young student,
an unlicensed amateur without qualification, who worked on the basis of trial&error.
In addition, this kernal basically started out as a terminal program that went out of control before it became Freax.
– Just like MCP in Tron started out as an chess program (hence its rigidness and unflexibility).
It’s no wonder that it became what it did, thus.
A good foundation is everything in construction.
If someone builds a house on a poor foundation it won’t last, no matter how much fixes came afterwards.
At this point, the best for Linux would be a complete rewrite, maybe.
– That also explains the positive acceptance of Rust an “A.I.”.
Maybe it can be done by re-using proven concepts and a sandbox for the device drivers.
After all, the many drivers written by helpers around the world are what makes Linux
run on so much hardware, rather than the monolithic kernal itself.
Without the compatibility to these drivers (at source level at least),
Linux would be more or less meaningless and exchangeable.
It’s like with Windows device drivers. Linux used to rely on wrappers (ndiswrapper etc) to support Windows W-LAN drivers, for example.
This Windows compatibility made it succeed in an increasingly more and more mobile world of computing.
The real tragedy, I think, is however, that no better open source OS came up in the past 30 years or so.
The success of Linux is comparable to that of former Windows 95, maybe.
Both were not really good but about good enough to not make users/developers desperate enough to seek for a better alternative.
That’s how the status quo and stagnation came to be. IMHO.
I’m not sure on what basis you are calling Linux “a success… comparable to Win95”, but sure, why not? My understanding of these matters was shaped by Richard Gabriel’s “Worse is better” or as he coined it, “New Jersey style”, a few years after it was written, I believe on some Usenet newsgroup. It doesn’t have to be good, just good enough. I was wondering, at the time, why people weren’t switching from Win95 to a free-as-in-beer linux, and why Visual Basic was becoming popular. Ironically, Gabriel was explaining why Unix and C would take over from LISP, I can only imagine what he thought of Win95. But for that matter, I think the principal applies widely in 21st century life and a good deal before that, as well.
Status Quo and Stagnation was always going to be the end result. It’s a minor miracle we aren’t still stuck on MS-DOS-based OSes. Disappointed in Linux? Have you tried working on a DOS extender? Do you have any idea how much worse it can get?
Of course better Open Source OSes have been developed. Better proprietary ones as well. But the first to market that is good enough wins every time. PS Gabriel’s later writing on the matter doesn’t interest me except as an example of pathology. Embrace the suck. Don’t think too much about it.
This is the inherent monopoly property of “free”.
In the short term “free” always seems like a good idea.
When I’m forced to use Windows, I’m seeing exactly the opposite. You pay for it, it should worth something, right?
Honestly, it’s so easy to criticize, but making something functional, stable (in both software stability and API stability), configurable from a 386 to a Petaflop computer network, that doesn’t enshitificate itself, all from a 1990’s tech stack is probably one of the best human success. And all that because one can explore a new idea and make a new driver for it freely. You don’t need, FailFS, up to you, but I’m 100% sure you’ll use it under the hood someday in one of your “container” experiment or whatever.
Would you believe anybody speaking about the airplane industry if they would not even know the most basic, how to write “airplane” and would write it aiorplan? Of course you would NOT. And anybody claiming to know what the kernel is, would not write it KERNAL. LOL
So where are those microkernels now? Certainly running on nearly every server and super computer in the world, and most phones right?
Oh wait no thats the linux kernel.
To my understanding, Android applications run on Android framework,
which is akin to .NET Framework on Windows or Mono on Linux.
It is thus possible to run Android software on different operating systems than Linux.
Servers historically also run on different versions of BSD, not just Linux exclusively.
In the 90s, major Unix OSes such as AIX, HP-UX or SunOS and Solaris existed, as well.
There were alternatives to Linux, albeit them not being as cheap.
*different kernels. The operating system is Android/AOSP.
Hah, good point! 🙂 Alright, Linux is *just *a kernal, we know. 🤓☝️
But to be fair, even the Linux author himself did forget that in interviews sometimes. ;)
What I meant to say is that Linux is the, um, driver backend used by Android.
The hardware dependent part of the whole system (plus network stack?).
It’s like an hardware abstraction layer (HAL) to Android.
To use an analogy, I think it is a bit like KickStart on Amiga,
which is the firmware but in practice also is a combination of firmware+the kernal+and AmigaDOS.
The Workbench then is the GUI running on top of it.
Comparable to how Android runs atop Linux.
That’s a bit simplified, of course.
But I’m no Android dev who could describe it more accurate and elegant. 😕
Depending on how we see it, Minix used to be the most widespread *nix -or OS, even- for a given period of time.
https://www.networkworld.com/article/964650/minix-the-most-popular-os-in-the-world-thanks-to-intel.html
No, that is ancient history, nobody cares what happened in 1532 (that is how far back in IT history that would be)
If you were right and minix would be relevant, it would have won out and we would be using it today still, which we are NOT.
You are free to fork it. What’s stopping you?
“rustic fs”
AI Agents and coding assistants need an immutable real machine with ephemeral storage and manual exfiltration, or their containerised jails which includes isolation to host and lan whilst allowing curated internet… and that jail needs to be very effective.
When we see recent CVEs like using wireplumber to escape a sandbox if there is a single place to write a file the host can see… this type of file system is only part of this puzzle for (either browser/media isolation or ai/devops) host security. It’s nice to see something that is deny by default though, I like that idea.
As a general user I just think all operating systems today carry around a lot of baggage. I used Windows for 30 years and while hardware advancements masks the bad older code and the generational bloat. The hardware improvements have now become unable to correct this. The RAM crisis forcing users to accept less RAM just exposes this problem even more. It’s not just the OS that’s the problem, its occurred with applications as well. I admire all operating systems and they all face a similar problem. They are all long in the tooth and need some serious attention going forward.
Interesting idea.
As for “Linux is bad” crowd, install Windows on a low powered computer. Try to use it. Then install Linux on it and use it. Nothing else needs to be said, you will be amazed at the difference.
“X is good because Y is worse”
Yes. And also: “best is the enemy of good”
more like “X is more useful than Y for the evaluated conditions.” Doesn’t mean Z couldn’t be better, but that assumes someone produces Z. Good luck to them.
Linux is changing, though. It is on its way to become an elitist’s OS, I think.
For a long time, Linux used to be the system to keep old hardware going; to many that was its main selling point.
A Linux OS was a favorite among hardware hackers, vintage fans,
computer hobbyists, hippies, enviromentalists and different thinking people.
Once a piece of hardware was supported it was there to stay.
But now support is being removed, thanks to Rust and LLMs, too.
And also because of the ban on Russian maintainers, maybe, which often maintained the cool vintage stuff.
The problem with this, is, that 486/586 CPU, NE2000, SB16, 3com 3c509b, ISA, FireWire, or PCMCIA cards are still current in PC emulation and virtual machines.
They may not be found in new consumer products, but in embedded hardware and software environments.
Sometimes they’re still an backwards compatibility option.:
Some Gigabit PCIe network cards from the 2010s still have NE2000 emulation, for example.
And in vintage computing, users currendly do build new legacy devices using Raspberry Picos and FPGAs.
To run DOS and Windows 98, to play classic games etc.
So the old hardware is re-born, but Linux nolonger supports it.
Despite most old/unmaintained device drivers being in a “stable” state.
Not my problem, but it paints a sad picture on Linux when DOS
and Windows 98 now start to have the better hardware support these days.
Not just for vintage hardware, but also new hardware.
There are now new NVME and 4K video drivers written for Windows 98 (and 3.1, even).
As a CB/ham radio fan, I’m also saddened how everything amateur radio is being removed from Linux.
Such as (A)X.25 protocol. X.25 was the forerunner of TCP/IP, basically.
Sure, ham radio applications may handle AX.25 all by it themself, but still.
It’s still very sad, but so its life. I had never thought to experience computing history long enough to see a “hero” become a “villain”.
Here’s a recent video I just saw that covers the Linux kernal situation:
https://www.youtube.com/watch?v=8vDSSxaQ7ZU
Or simply install Windows XP with POSready 2009 updates and see how it flies on hardware that Linux merely runs.
Because that’s whats actually happened in late 2000s when netbooks and nettops were new device classes.
Linux and Vista were to bloated to run on humble hardware..
But Windows XP had no problem running on a system with Intel Atom CPU, GMA900 GPU and 256 to 512 MB RAM.
I suppose it’s OK for the spooks to run, but is it needed for joe average? And aren’t there tons of loopholes in this thing to exploit? At a time where all the hackers have AI to assist.
I think they should perhaps avoid going on this file system mania that some people are afflicted with, which is similar to a keyboard mania, where some folks buy 50 keyboards only to discover they only have 2 hands, and they use the touchscreen keyboard most of the time. Oh and they discover they are broke since they spent a fortune on keyboards.
Another step in Linux’ slow progress toward feature parity with the 1970s state of the art.
Entrenched practice is a cruel mistress.
History doesn’t repeat but it sure does rhyme.
i don’t see the benefit over simply using chroot to an empty unwritable directory. failfs and nullfs are no doubt useful for testing, and perhaps even for some single-process / single-function deployments, but it seems like they are neither here-nor-there for security
I think the point is that its a paradigm shift going forward towards default deny for file system access. IMO we’re 20 years past the point where it was reasonable for every random utility from the internet to be able to access huge portions of your files. This is doublely true because most modern tools include other dependencies, of which only a single one needs to be compromised.
but it still relies on chroot, so the new default-deny is no different from the old default-deny?
Oh! I thought this article was going to be about one of the filesystems that still used MD5SUM!