Skip to content
Hallway
0:00 / 0:00

#crostini#chromeos#crosvm

Linux for Chromebooks: Secure Development (Google I/O ’19)

Chrome for Developers

822K subscribers • 20 videos on Hallway

YouTube
  • Recommended by 1 person: 1 on Hacker News.
  • Presented by Dylan Reid, Tom Buckley, and Sudha Broslawsky
  • Made by the vendor. The company whose product it covers made or sponsored it.

Intermediate. Assumes working knowledge.

238K views7 years ago1 recommendation

Systems programmingSecurityOperating systemsLinuxDocker and containers

Dylan Reid, Tom Buckley, and Sudha Broslawsky explain the architecture and sandboxing design of Crostini, the Linux environment on ChromeOS.

Learn how Linux for Chromebooks (Crostini) gives you a secure sandbox for development. Through a variety of demos, this talk will explain the architecture underlying Linux for Chromebooks and the design decisions that keep it easy to use. Watch more #io19 here: Web at Google I/O 2019 Playlist → goo.gle/io19web Google I/O 2019 All Sessions Playlist → goo.gle/io19allsessions Learn more on the I/O Website → google.com/io Subscribe to the Chrome Developers Channel → goo.gle/ChromeDevs Get started at → google.com/chrome/dev/ Speaker(s): Dylan Reid, Tom Buckley, Sudha Broslawsky TD69F6 event: Google I/O 2019; re_ty: Publish; fullname: Dylan Reid, Tom Buckley, Sudha Broslawsky;

Why it's here

1 person recommends this

What people say. Recommended for its detailed explanation of the defense-in-depth sandboxing and VM architecture used to secure Linux on ChromeOS.

est31on Hacker News • Recommends

On “Fixing the Desktop Linux Security Model”

Chrome OS is a very secure Linux distro. While the base system is very restricted, they also support Linux sandboxes, making it secure for you to use the computer both for online banking and for downloading random code from the internet. Check out the talk "Linux for Chromebooks: Secure Development": link to this video
View on Hacker News

jt2190on Hacker News • Mentions

On “All Chromebooks will also be Linux laptops going forward”

Video of the talk: Linux for Chromebooks, (A.K.A Crostini): Secure Development presented by Sudha Broslawsky, Tom Buckley, and Dylan Reid at Google I/O 2019 link to this video Some technical details: * Container: Crostini (default is Debian 9) * Guest: Termina VM: LXD 1, Linux Kernel * Host: CrOS: crosvm, Linux Kernel Drivers are run in "minijails" to minimize exposure. Files are shared from container to OS via 9P 2. Google is calling theirs "9S" Edit: I think this in-depth document may be up to date: "Running Custom Containers Under Chrome OS" link 1 from Canonical, see link 2 link
View on Hacker News

pjmlpon Hacker News • Mentions

On “Banned C standard library functions in Git source code”

Well, you can see how they are locking it down with containers sandboxing from an IO talk, by making use of gVisor and a Rust based containers. "Linux for Chromebooks: Secure Development" link to this video
View on Hacker News

pjmlpon Hacker News • Mentions

On “What happens when you launch Google Chrome for the first time?”

Regarding ChromeOS: "Linux for Chromebooks: Secure Development" > Learn how Linux for Chromebooks (Crostini) gives you a secure sandbox for development. Through a variety of demos, this talk will explain the architecture underlying Linux for Chromebooks and the design decisions that keep it easy to use. link to this video And Android: "Adopting the Arm Memory Tagging Extension in Android" link " link link "Improving Stability with Private C/C++ Symbol Restrictions in Android N" link "Android NDK Native APIs" link
View on Hacker News

est31on Hacker News • Mentions

On “Parents Thought They Wanted Tech in Every Classroom, Now They’re Not So Sure”

You can now have sandboxes where you can install desktop tools without having to enable stuff like developer mode: link to this video Sandboxing this stuff away is in general a good idea for protecting "normal" users. People often want to install pirated games or whatever and that's abused as a vector to get malware onto those devices. If that's not enough you can install entirely different operating systems and even bootloaders (if you want to).
View on Hacker News

cromwellianon Hacker News • Mentions

On “A Message about iOS Security”

…is much more confined. That Google has exposed their infrastructure to the unforgiving nature of the Web for 2 decades, with exploits few and far between, is a testament to the quality of the security engineers. The most secure device on the planet, isn't iOS, it's Chromebooks. Look at the defense-in-depth used on Chromebooks to isolate execution: link to this video…
View on Hacker News

est31on Hacker News • Mentions

On “Stealing secrets from developers using WebSockets”

You're likely not even safe from this if you are using Chrome OS. It does sandbox the localhost web server 1 2, but it does not restrict access to it from the host. 1: link to this video 2: link
View on Hacker News

pjmlpon Hacker News • Mentions

On “ChromeOS is splitting the browser from the OS, getting more Linux-y”

That is a VM, similar in concept to WSL on Windows, with the difference that the host is also Linux based. "Linux for Chromebooks: Secure Development" link to this video link link
View on Hacker News

mdhbon Hacker News • Mentions

On “WASM Is the New CGI”

…which is essentially Debian in a VM the level of care that went into making sure that no matter what happens there you will never suffer a full system compromise is truly impressive. To give you a sense of where they were half a decade ago you can already see that it’s as I described miles in front of anything that exists even today in this video: link to this video When we get to talking about when they went for a total ground up first principles approach with Fuchsia as a next generation operating system that is something else entirely on a different level again. I genuinely didn’t have a hint of irony in my original comment. They are actually that much better when it comes to security.…
View on Hacker News