Ubuntu Application Confinement - gould.cx · Ubuntu Application Confinement Or: How I learned to...
Transcript of Ubuntu Application Confinement - gould.cx · Ubuntu Application Confinement Or: How I learned to...
![Page 1: Ubuntu Application Confinement - gould.cx · Ubuntu Application Confinement Or: How I learned to stop worrying and trust application developers ... OOM Killer (want to include graphics](https://reader033.fdocuments.in/reader033/viewer/2022042220/5ec6f0012edf2e5e976b7a3e/html5/thumbnails/1.jpg)
Ubuntu Application Confinement
Or: How I learned to stop worrying and trust application developers
Ubuntu Application Confinement
Or: How I learned to stop worrying and trust application developers
Ted [email protected]@tedjgouldSMU3 Sept 2014
![Page 2: Ubuntu Application Confinement - gould.cx · Ubuntu Application Confinement Or: How I learned to stop worrying and trust application developers ... OOM Killer (want to include graphics](https://reader033.fdocuments.in/reader033/viewer/2022042220/5ec6f0012edf2e5e976b7a3e/html5/thumbnails/2.jpg)
“I'm more worried about Murphy than I am Machievilli”
— Michi Henning
![Page 3: Ubuntu Application Confinement - gould.cx · Ubuntu Application Confinement Or: How I learned to stop worrying and trust application developers ... OOM Killer (want to include graphics](https://reader033.fdocuments.in/reader033/viewer/2022042220/5ec6f0012edf2e5e976b7a3e/html5/thumbnails/3.jpg)
IdealCracker
![Page 4: Ubuntu Application Confinement - gould.cx · Ubuntu Application Confinement Or: How I learned to stop worrying and trust application developers ... OOM Killer (want to include graphics](https://reader033.fdocuments.in/reader033/viewer/2022042220/5ec6f0012edf2e5e976b7a3e/html5/thumbnails/4.jpg)
Diminished User Experience
![Page 5: Ubuntu Application Confinement - gould.cx · Ubuntu Application Confinement Or: How I learned to stop worrying and trust application developers ... OOM Killer (want to include graphics](https://reader033.fdocuments.in/reader033/viewer/2022042220/5ec6f0012edf2e5e976b7a3e/html5/thumbnails/5.jpg)
© Andy Armstrong — CC-BY-SA — https://www.flickr.com/photos/andyarmstrong/190078748/
DeadBattery
![Page 6: Ubuntu Application Confinement - gould.cx · Ubuntu Application Confinement Or: How I learned to stop worrying and trust application developers ... OOM Killer (want to include graphics](https://reader033.fdocuments.in/reader033/viewer/2022042220/5ec6f0012edf2e5e976b7a3e/html5/thumbnails/6.jpg)
© Josh Hallett — CC-BY — https://www.flickr.com/photos/hyku/368912557/
DataProtection
![Page 7: Ubuntu Application Confinement - gould.cx · Ubuntu Application Confinement Or: How I learned to stop worrying and trust application developers ... OOM Killer (want to include graphics](https://reader033.fdocuments.in/reader033/viewer/2022042220/5ec6f0012edf2e5e976b7a3e/html5/thumbnails/7.jpg)
© Antti T. Nissinen — CC-BY — https://www.flickr.com/photos/54177777@N00/373864777/
PhysicalDestruction
![Page 8: Ubuntu Application Confinement - gould.cx · Ubuntu Application Confinement Or: How I learned to stop worrying and trust application developers ... OOM Killer (want to include graphics](https://reader033.fdocuments.in/reader033/viewer/2022042220/5ec6f0012edf2e5e976b7a3e/html5/thumbnails/8.jpg)
Phone Usage
http://hbr.org/2013/01/how-people-really-use-mobile/
![Page 9: Ubuntu Application Confinement - gould.cx · Ubuntu Application Confinement Or: How I learned to stop worrying and trust application developers ... OOM Killer (want to include graphics](https://reader033.fdocuments.in/reader033/viewer/2022042220/5ec6f0012edf2e5e976b7a3e/html5/thumbnails/9.jpg)
PID
Click Manifest
Desktop File
Helper Config
Unity Screen
AppArmor Profile
Upstart Instance
![Page 10: Ubuntu Application Confinement - gould.cx · Ubuntu Application Confinement Or: How I learned to stop worrying and trust application developers ... OOM Killer (want to include graphics](https://reader033.fdocuments.in/reader033/viewer/2022042220/5ec6f0012edf2e5e976b7a3e/html5/thumbnails/10.jpg)
App
App
![Page 11: Ubuntu Application Confinement - gould.cx · Ubuntu Application Confinement Or: How I learned to stop worrying and trust application developers ... OOM Killer (want to include graphics](https://reader033.fdocuments.in/reader033/viewer/2022042220/5ec6f0012edf2e5e976b7a3e/html5/thumbnails/11.jpg)
AppAppArmor Profile
![Page 12: Ubuntu Application Confinement - gould.cx · Ubuntu Application Confinement Or: How I learned to stop worrying and trust application developers ... OOM Killer (want to include graphics](https://reader033.fdocuments.in/reader033/viewer/2022042220/5ec6f0012edf2e5e976b7a3e/html5/thumbnails/12.jpg)
Syscalls
Linux Security Module
Process
Linux
![Page 13: Ubuntu Application Confinement - gould.cx · Ubuntu Application Confinement Or: How I learned to stop worrying and trust application developers ... OOM Killer (want to include graphics](https://reader033.fdocuments.in/reader033/viewer/2022042220/5ec6f0012edf2e5e976b7a3e/html5/thumbnails/13.jpg)
App Writable Area~/.cache/$(pkg)~/.local/share/$(pkg)~/.config/$(pkg)
App Readable Area/usr/share/icons//bin/sh/usr/bin/qmlscene
App Restricted Area~/.cache/$(other pkg)~/.local/share/address-book~/Documents/
![Page 14: Ubuntu Application Confinement - gould.cx · Ubuntu Application Confinement Or: How I learned to stop worrying and trust application developers ... OOM Killer (want to include graphics](https://reader033.fdocuments.in/reader033/viewer/2022042220/5ec6f0012edf2e5e976b7a3e/html5/thumbnails/14.jpg)
AppMirDBus
![Page 15: Ubuntu Application Confinement - gould.cx · Ubuntu Application Confinement Or: How I learned to stop worrying and trust application developers ... OOM Killer (want to include graphics](https://reader033.fdocuments.in/reader033/viewer/2022042220/5ec6f0012edf2e5e976b7a3e/html5/thumbnails/15.jpg)
Mir Server Mir Client
Graphics HW
Unity App
![Page 16: Ubuntu Application Confinement - gould.cx · Ubuntu Application Confinement Or: How I learned to stop worrying and trust application developers ... OOM Killer (want to include graphics](https://reader033.fdocuments.in/reader033/viewer/2022042220/5ec6f0012edf2e5e976b7a3e/html5/thumbnails/16.jpg)
App 1
App 2
Mir
Device Display
![Page 17: Ubuntu Application Confinement - gould.cx · Ubuntu Application Confinement Or: How I learned to stop worrying and trust application developers ... OOM Killer (want to include graphics](https://reader033.fdocuments.in/reader033/viewer/2022042220/5ec6f0012edf2e5e976b7a3e/html5/thumbnails/17.jpg)
ApplicationSwitcher
![Page 18: Ubuntu Application Confinement - gould.cx · Ubuntu Application Confinement Or: How I learned to stop worrying and trust application developers ... OOM Killer (want to include graphics](https://reader033.fdocuments.in/reader033/viewer/2022042220/5ec6f0012edf2e5e976b7a3e/html5/thumbnails/18.jpg)
Presentation Application Switcher
![Page 19: Ubuntu Application Confinement - gould.cx · Ubuntu Application Confinement Or: How I learned to stop worrying and trust application developers ... OOM Killer (want to include graphics](https://reader033.fdocuments.in/reader033/viewer/2022042220/5ec6f0012edf2e5e976b7a3e/html5/thumbnails/19.jpg)
Infinite App Illusion
Technical User
How many apps can I run?
1 GB RAM1 GHz Quad Core
![Page 20: Ubuntu Application Confinement - gould.cx · Ubuntu Application Confinement Or: How I learned to stop worrying and trust application developers ... OOM Killer (want to include graphics](https://reader033.fdocuments.in/reader033/viewer/2022042220/5ec6f0012edf2e5e976b7a3e/html5/thumbnails/20.jpg)
Active Application
Paused Apps (RAM)
Stopped Offline
![Page 21: Ubuntu Application Confinement - gould.cx · Ubuntu Application Confinement Or: How I learned to stop worrying and trust application developers ... OOM Killer (want to include graphics](https://reader033.fdocuments.in/reader033/viewer/2022042220/5ec6f0012edf2e5e976b7a3e/html5/thumbnails/21.jpg)
Stateless Stopped
Paused
Active
![Page 22: Ubuntu Application Confinement - gould.cx · Ubuntu Application Confinement Or: How I learned to stop worrying and trust application developers ... OOM Killer (want to include graphics](https://reader033.fdocuments.in/reader033/viewer/2022042220/5ec6f0012edf2e5e976b7a3e/html5/thumbnails/22.jpg)
Stateless Stopped
Paused
Active
UserInteractionOnly!!!
![Page 23: Ubuntu Application Confinement - gould.cx · Ubuntu Application Confinement Or: How I learned to stop worrying and trust application developers ... OOM Killer (want to include graphics](https://reader033.fdocuments.in/reader033/viewer/2022042220/5ec6f0012edf2e5e976b7a3e/html5/thumbnails/23.jpg)
Paused
Active
Stateless Stopped
![Page 24: Ubuntu Application Confinement - gould.cx · Ubuntu Application Confinement Or: How I learned to stop worrying and trust application developers ... OOM Killer (want to include graphics](https://reader033.fdocuments.in/reader033/viewer/2022042220/5ec6f0012edf2e5e976b7a3e/html5/thumbnails/24.jpg)
Stateless
Active
Stopped
Paused Linux KernelOOM Killer
(want to include graphics resources in the future)
![Page 25: Ubuntu Application Confinement - gould.cx · Ubuntu Application Confinement Or: How I learned to stop worrying and trust application developers ... OOM Killer (want to include graphics](https://reader033.fdocuments.in/reader033/viewer/2022042220/5ec6f0012edf2e5e976b7a3e/html5/thumbnails/25.jpg)
Stateless Stopped
Paused
Active
![Page 26: Ubuntu Application Confinement - gould.cx · Ubuntu Application Confinement Or: How I learned to stop worrying and trust application developers ... OOM Killer (want to include graphics](https://reader033.fdocuments.in/reader033/viewer/2022042220/5ec6f0012edf2e5e976b7a3e/html5/thumbnails/26.jpg)
What happens:● App is asked to save
state● Graphic buffers
grabbed for screenshot● Timeout, then all
processes are sent SIGSTOP
Paused
Active
Stateless Stopped
![Page 27: Ubuntu Application Confinement - gould.cx · Ubuntu Application Confinement Or: How I learned to stop worrying and trust application developers ... OOM Killer (want to include graphics](https://reader033.fdocuments.in/reader033/viewer/2022042220/5ec6f0012edf2e5e976b7a3e/html5/thumbnails/27.jpg)
What happens:● NOTHING!Stateless
Active
Stopped
Paused
![Page 28: Ubuntu Application Confinement - gould.cx · Ubuntu Application Confinement Or: How I learned to stop worrying and trust application developers ... OOM Killer (want to include graphics](https://reader033.fdocuments.in/reader033/viewer/2022042220/5ec6f0012edf2e5e976b7a3e/html5/thumbnails/28.jpg)
Positive:Ask to save state nicely via life cycleStop using processing when not asked
Negative:SIGSTOP appsSIGKILL apps on OOM killer
![Page 29: Ubuntu Application Confinement - gould.cx · Ubuntu Application Confinement Or: How I learned to stop worrying and trust application developers ... OOM Killer (want to include graphics](https://reader033.fdocuments.in/reader033/viewer/2022042220/5ec6f0012edf2e5e976b7a3e/html5/thumbnails/29.jpg)
Like
ly t
o b
e k
illed
Stopped App
Untrusted Helpers
Active Application
Unity
![Page 30: Ubuntu Application Confinement - gould.cx · Ubuntu Application Confinement Or: How I learned to stop worrying and trust application developers ... OOM Killer (want to include graphics](https://reader033.fdocuments.in/reader033/viewer/2022042220/5ec6f0012edf2e5e976b7a3e/html5/thumbnails/30.jpg)
AppMirDBus
![Page 31: Ubuntu Application Confinement - gould.cx · Ubuntu Application Confinement Or: How I learned to stop worrying and trust application developers ... OOM Killer (want to include graphics](https://reader033.fdocuments.in/reader033/viewer/2022042220/5ec6f0012edf2e5e976b7a3e/html5/thumbnails/31.jpg)
DBus
Service ServiceApp
![Page 32: Ubuntu Application Confinement - gould.cx · Ubuntu Application Confinement Or: How I learned to stop worrying and trust application developers ... OOM Killer (want to include graphics](https://reader033.fdocuments.in/reader033/viewer/2022042220/5ec6f0012edf2e5e976b7a3e/html5/thumbnails/32.jpg)
Header
Type Signal or Method
Destination :0.54 or “com.canonical.Unity”
Path /com/canonical/Unity/Dash
Interface com.canonical.unity.dash
Method ShowAttention
Payload [“foo”, “bar”]
DBus Message
![Page 33: Ubuntu Application Confinement - gould.cx · Ubuntu Application Confinement Or: How I learned to stop worrying and trust application developers ... OOM Killer (want to include graphics](https://reader033.fdocuments.in/reader033/viewer/2022042220/5ec6f0012edf2e5e976b7a3e/html5/thumbnails/33.jpg)
Service ServiceApp
AppArmor says NO!!!
![Page 34: Ubuntu Application Confinement - gould.cx · Ubuntu Application Confinement Or: How I learned to stop worrying and trust application developers ... OOM Killer (want to include graphics](https://reader033.fdocuments.in/reader033/viewer/2022042220/5ec6f0012edf2e5e976b7a3e/html5/thumbnails/34.jpg)
App
Location
Online Accounts
URL Dispatcher
Address Book
AppArmorTrustedConfined
DBus Trusted Helpers
![Page 35: Ubuntu Application Confinement - gould.cx · Ubuntu Application Confinement Or: How I learned to stop worrying and trust application developers ... OOM Killer (want to include graphics](https://reader033.fdocuments.in/reader033/viewer/2022042220/5ec6f0012edf2e5e976b7a3e/html5/thumbnails/35.jpg)
App
URL Dispatcher
Upstart
Browser
Unity
USERClick on a link Show the browser
![Page 36: Ubuntu Application Confinement - gould.cx · Ubuntu Application Confinement Or: How I learned to stop worrying and trust application developers ... OOM Killer (want to include graphics](https://reader033.fdocuments.in/reader033/viewer/2022042220/5ec6f0012edf2e5e976b7a3e/html5/thumbnails/36.jpg)
Request permission at time of use
![Page 37: Ubuntu Application Confinement - gould.cx · Ubuntu Application Confinement Or: How I learned to stop worrying and trust application developers ... OOM Killer (want to include graphics](https://reader033.fdocuments.in/reader033/viewer/2022042220/5ec6f0012edf2e5e976b7a3e/html5/thumbnails/37.jpg)
Ubuntu Applications are¹:● ELF Binaries● Link to C libs● Draw on an EGL Buffer
Review (1/2)
¹ This is really only from a confinement/lifecycle perspective, we have a really nice QML SDK that makes application author's lives much easier, you should use it if you can.
![Page 38: Ubuntu Application Confinement - gould.cx · Ubuntu Application Confinement Or: How I learned to stop worrying and trust application developers ... OOM Killer (want to include graphics](https://reader033.fdocuments.in/reader033/viewer/2022042220/5ec6f0012edf2e5e976b7a3e/html5/thumbnails/38.jpg)
Ubuntu Applications are:● Confined. By default the applications are
restricted from using a lot of functionality that might be expected from a traditional Linux user session.
● Managed. The application lifecycle works to keep the user in control of what is draining the battery and using resources.
● Have Friends. Trusted helpers provide ways to implement the functionality you need and work with confinement.
Review (2/2)
![Page 39: Ubuntu Application Confinement - gould.cx · Ubuntu Application Confinement Or: How I learned to stop worrying and trust application developers ... OOM Killer (want to include graphics](https://reader033.fdocuments.in/reader033/viewer/2022042220/5ec6f0012edf2e5e976b7a3e/html5/thumbnails/39.jpg)
Additional Info
http://www.ubuntu.com/phone
https://developer.ubuntu.com
https://wiki.ubuntu.com/Security/AppArmor
https://wiki.ubuntu.com/Mir
![Page 40: Ubuntu Application Confinement - gould.cx · Ubuntu Application Confinement Or: How I learned to stop worrying and trust application developers ... OOM Killer (want to include graphics](https://reader033.fdocuments.in/reader033/viewer/2022042220/5ec6f0012edf2e5e976b7a3e/html5/thumbnails/40.jpg)
© Stéfan — CC-BY-SA — https://www.flickr.com/photos/st3f4n/143623934