Title: OpenKuBSD progress report | |
Author: Solène | |
Date: 16 June 2023 | |
Tags: openbsd security | |
Description: In this news I'm sharing my progress into writing the | |
OpenBSD based compartimentalization tool OpenKuBSD. | |
# Introduction | |
Here is a summary of my progress for writing OpenKuBSD. So far, I've | |
had a few blockers but I've been able to find solutions, more or less | |
simple and nice, but overall I'm really excited about how the project | |
is turning out. | |
OpenKuBSD source code on tildegit.org (current branch == PoC) | |
As a quick introduction to OpenKuBSD in its current state, it's a | |
program to install on top of OpenBSD, using mostly base system tools. | |
* OpenBSD templates can be created and configured | |
* Kubes (VMs) inherit an OpenBSD template for the disk, except for a | |
dedicated persistent /home, any changes outside of /home will be reset | |
on each boot | |
* Kubes have a nice name like "www.kube" to connect to | |
* NFS storage per Kube in /shared/ , this allows data to be shared with | |
the host, which can then move files between Kubes via the shared | |
directories | |
* Xephyr based compartimentalization for GUI display. Each program run | |
has its own Xephyr server. | |
* Clipboard manipulation tool: a utility for copying the clipboard from | |
one Xephyr to another one. This is a secure way to share the clipboard | |
between Kubes without leakage. | |
* On-demand start and polling for ssh connection, so you don't have to | |
pre-start a Kube before running a program. | |
* Executable `/home/openkubsd/rc.local` script at boot time to | |
customize an environment at kube level rather than template level | |
* Desktop entry integration: a script is available to create desktop | |
entries to run program X on Kube Y, directly from the menu | |
The Xephyr trick was hard to figure and implement correctly. | |
Originally, I used `ssh -Y` which worked fine, and integrated very well | |
with the desktop however: | |
* ssh -Y allows any window to access the X server, meaning any hacked | |
VM could access all other running programs | |
* ssh -X is secure, but super bad: slow, can't have a custom layout, | |
crashes when trying to do access X in some cases. (fun fact, on Fedora, | |
ForwardX11Trusted seems to be set to Yes by default, so ssh -X does ssh | |
-Y!) | |
* Xephyr worked, but running a program in it didn't use the full | |
display, so a window manager was required. But all the tiling window | |
managers I used (to automatically use all the screen) couldn't resize | |
when Xephyr was resized.... except stumpwm! | |
* Stumpwm custom configuration to quit when it has no more window | |
displayed. If you exit your programs then stumpwm quits then Xephyr | |
stops. | |
# Demo videos | |
OpenKuBSD: easily running programs from VMs | |
OpenKuBSD: NFS shares and desktop entries | |
OpenKuBSD: Xephyr implementation and clipboard helper | |
# Roadmap | |
I'm really getting satisfied with the current result. It's still far | |
from being ready to ship or feature complete, but I think the | |
foundations are quite cool. | |
Next steps: | |
* tighten the network access for each Kube using PF (only NAT + host | |
access + prevent spoofing) | |
* allow a Kube to not have NAT (communication would be restricted to | |
the host only for ssh access), this is the most "no network" | |
implementation I can achieve. | |
* allow a Kube to have a NAT from another Kube (to handle a Kube VPN | |
for a specific list of Kubes) | |
* figure how to make a Tor VPN Kube | |
* allow to make disposable Kubes using the Tor VPN Kube network | |
Mid term steps: | |
* support Alpine Linux (with features matching what OpenBSD Kubes have) | |
Long term steps: | |
* rewrite all OpenKuBSD shell implementation into a daemon/client | |
model, easier to install, more robust | |
* define a configuration file format to declare all the infrastructure | |
* release to wider audience | |
* open a bug tracker | |
# Conclusion | |
The project is still in its beginning, but I made important progress | |
over the last two weeks, I may reduce the pace here a bit to get | |
everything stabilized. I started using OpenKuBSD on my own computer, | |
this helps a lot to refine the workflow and see what feature matter, | |
and which design is wrong or correct. | |
I hope you like that project as much as I do. |