Minix 3 and the microkernel experience

Minix Firewall Project

Packet filters are an endangered system component. Despite the excellent quality of the Linux Netfilter implementation, a number of security issues have surfaced in the past. If a subsystem of this kind is running on the Linux kernel, it will endanger system security. Building on work by the Tanenbaum group, the Technical University of Applied Science Berlin ported the widespread Netfilter framework to Minix 3 [5].

Here again, the stability of the microkernel architecture delivers additional benefits. In Linux, an attacker who succeeds in provoking a crash – for example, by exploiting a buffer overflow in the do_replace() function – can bring a Linux firewall to its knees. In Minix 3, a single user process could crash without compromising system security. The reincarnation server would simply restart the process.

Figure 2: Minix is very spartan on launching. This said, version 3.1.2a does include an X11 interface and developer tools.

The differences become even more apparent if an attacker succeeds in executing code. In Minix, a hijacked user process is still a problem, but the effect is far less serious thanks to isolation.

Even Microsoft is exploring their own microkernel system, named Singularity [6]. Although Minix has played the microkernel game for many years now, its biggest obstacle to becoming more widespread has always been its non-free license. Now that Minix 3 is released under the BSD open source license and the firewall extensions are available under the GPL [7]. Researchers at the TFH Berlin are also working on exploring Minix's potential as a virtualized firewall. Stability, a small footprint, and a new licensing model give Minix 3 a strong potential for growth, especially in embedded systems.

Infos

  1. Tanenbaum, Andrew S., "Some Notes on the 'Who wrote Linux' Kerfuffle, Release 1.5," 2004, http://www.cs.vu.nl/~ast/brown/
  2. Minix Project: http://www.minix3.org
  3. Torvalds, Linus, and David Diamond. Just for Fun. HarperBusiness, 2001
  4. Tanenbaum, Andrew S., and Albert S. Woodhull. The Minix Book: Operating System Design and Implementation. Prentice-Hall, 2006
  5. Weis, Rüdiger, "Linux is obsolete 2.0," presented at Chaos Communication Camp 2007, http://public.tfh-berlin.de/~rweis/vorlesungen/ComputerSicherheit/WeisLinuxIsObsolete2.pdf
  6. Microsoft Singularity: http://www.codeplex.com/singularity
  7. Minixwall: http://wiki.tfh-berlin.de/~minixwall

The Author

Rüdiger Weis is a professor of system programming at TFH Berlin. Between 2002 and 2005, he was involved in post-doctorate research on secure operating systems under Professor Andrew S. Tanenbaum at the Vrije Universiteit, Amsterdam.

« Previous 1 2

Buy this article as PDF

Express-Checkout as PDF
Price $2.95
(incl. VAT)

Buy Linux Magazine

SINGLE ISSUES
Print Issues
Digital Issues
 
SUBSCRIPTIONS
Print Subs
Digisubs
 
TABLET & SMARTPHONE APPS
Get it on Google Play

US / Canada

Get it on Google Play

UK / Australia

Related content

comments powered by Disqus

Visit Our Shop

Trial Subscription

Digital Subscription

Subscribe

Direct Download

Read full article as PDF:

Minix_3_Review.pdf  (924.44 kB)

News

Tag Cloud

Administration Community Desktop Events Hardware Linux Linux Pro Magazine Mobile Programming Software Ubuntu Web Development Windows free software open source