Software is written to run on Linux (desktop, server, Android) though, and a more secure OS without applications for it isn't much good. I think in the long term, the ideal would be having a robust microkernel with drivers, filesystems, etc. divided up and isolated well.
Conversation
It needs a way to run existing applications though. The virtualization approach is the most realistic / pragmatic right now. Ideally, I'd like to see a Linux compatibility layer able to avoid having the Linux kernel in the guest, and virtualization could also become optional.
1
1
I think github.com/google/gvisor is very cool, but it isn't quite what I want since it's designed to run on top of the Linux kernel on the host. It's close to what I want though: a memory safe Linux kernel API implementation able to run without privileges. It's at least progress.
2
1
Over the years I saw similar projects come from Google like novm, unfortunately they never graduated beyond proof-of-concept stage.
1
github.com/google/gvisor is more than a proof of concept, and the KVM platform implementation is close to what I want. It provides a way to have a "Linux" virtual machine without a Linux kernel. It runs on top of Linux on the host though, so it'd need to be ported elsewhere.
2
1
If we want the services provided by Linux, we have to run it somewhere either as host or guest. I have no basic issues with the Qubes+Xen virtual model; its robust in practice and clear-headed in concept. Feature-rich kernels are good to have if they run as guests.
1
A guest being compromised is still a problem even when it's isolated from the rest of the system. The security of the guests still matters and the Linux kernel is large part of their attack surface and is the weak link for sandboxes they have internally like the Chromium sandbox.
2
But then we're talking about sandboxes within sandboxes. Qubes focuses the user's attention on the qube/vm as the tool to manage risk. And I say this as author of a project that aims to improve Qubes guest security:
2
For example, for messaging, you could have a Qube for each identity you use if you can afford the memory requirements. However, it's still a serious problem if the messaging application is compromised and your key, contacts and all the logs for that identity are obtained...
1
The messaging client can have sandboxing to divide things up per messaging contact, so that one contact compromising you with an image / video doesn't lead to them gaining full access to the rest of the data. That's how Chromium's sandbox works with site isolation for browsing.