Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.arch.embedded > #10789 > unrolled thread

CPU's and boards for hobbyists?

Back to article view | Back to comp.arch.embedded

Contents

  CPU's and boards for hobbyists? Mel Wilson <mwilson@the-wire.com> - 2012-12-13 11:39 -0500
    Re: CPU's and boards for hobbyists? Simon Clubley <clubley@remove_me.eisner.decus.org-Earth.UFP> - 2012-12-13 17:57 +0000
    Re: CPU's and boards for hobbyists? Alu Phong <invalid@invalid.com> - 2012-12-19 15:11 +1100
      Re: CPU's and boards for hobbyists? Simon Clubley <clubley@remove_me.eisner.decus.org-Earth.UFP> - 2012-12-19 12:34 +0000
    Re: CPU's and boards for hobbyists? Les Cargill <lcargill99@comcast.com> - 2012-12-18 23:16 -0600

#10789 — CPU's and boards for hobbyists?

Another sighting: Chumby Hacker board <http://www.adafruit.com/products/278>

(This is an old thread, and lots of posts have expired.  Have we already 
talked about this one?)

I start to think that the Linux-based boards are a completely different 
tribe from the smaller processors, and would need a completely different 
treatment.  With a hardware-centric solution I would never be thinking about 
using SysV IPC to put a firedoor between the GPIO-controlling processes 
(which need root privileges on the Raspberry Pi) and the Internet-facing 
processes.

	Mel.

[toc] | [next] | [standalone]

#10792

On 2012-12-13, Mel Wilson <mwilson@the-wire.com> wrote:
> Another sighting: Chumby Hacker board <http://www.adafruit.com/products/278>
>
> (This is an old thread, and lots of posts have expired.  Have we already 
> talked about this one?)
>

I don't recall seeing it.

Ignoring the sensors, it looks comparable to the Olimex boards here:

https://www.olimex.com/Products/OLinuXino/iMX233/

The Olimex boards are cheaper, but they do not have the sensors onboard
that the above board does.

> I start to think that the Linux-based boards are a completely different 
> tribe from the smaller processors, and would need a completely different 
> treatment.  With a hardware-centric solution I would never be thinking about 
> using SysV IPC to put a firedoor between the GPIO-controlling processes 
> (which need root privileges on the Raspberry Pi) and the Internet-facing 
> processes.
>

I suppose it depends on what you are going to do with them. I have come
up with a number of project ideas for these types of boards, but none of
them involve any public facing Internet connection, so that's not a issue
I have yet had to tackle, but I agree with the role seperation.

I wonder if the versions of Linux running on these boards support SELinux ?
I could see the benefits of creating a heavily restricted SELinux profile
for the internet component in your above setup in case someone managed to
break through your Internet facing process above.

I use SELinux on all my Internet facing Linux boxes, both at home and work,
and I consider it something useful to have active in case the system
security is ever compromised, although (as always) there are no guarantees
here. :-)

Simon.

-- 
Simon Clubley, clubley@remove_me.eisner.decus.org-Earth.UFP
Microsoft: Bringing you 1980s technology to a 21st century world

[toc] | [prev] | [next] | [standalone]

#10859

On 2012-12-14 03:39:43 +1100, Mel Wilson said:

> Another sighting: Chumby Hacker board <http://www.adafruit.com/products/278>
> 
> (This is an old thread, and lots of posts have expired.  Have we already
> talked about this one?)
> 
> I start to think that the Linux-based boards are a completely different
> tribe from the smaller processors, and would need a completely different
> treatment.  With a hardware-centric solution I would never be thinking about
> using SysV IPC to put a firedoor between the GPIO-controlling processes
> (which need root privileges on the Raspberry Pi) and the Internet-facing
> processes.
> 
> 	Mel.

I don't understand why you would need a fire door in the first place. 
At most you are not sinking very much current from a MCU, hardly enough 
to start a fire. Building a fire door might be a fun project, i.e. temp 
detection, servo to close off oxygen supply but it is not necessary. I 
find this typical of the folks who use Linux on VSCDs (Very Small 
Computing Devices).

[toc] | [prev] | [next] | [standalone]

#10862

On 2012-12-18, Alu Phong <invalid@invalid.com> wrote:
> On 2012-12-14 03:39:43 +1100, Mel Wilson said:
>
>> Another sighting: Chumby Hacker board <http://www.adafruit.com/products/278>
>> 
>> (This is an old thread, and lots of posts have expired.  Have we already
>> talked about this one?)
>> 
>> I start to think that the Linux-based boards are a completely different
>> tribe from the smaller processors, and would need a completely different
>> treatment.  With a hardware-centric solution I would never be thinking about
>> using SysV IPC to put a firedoor between the GPIO-controlling processes
>> (which need root privileges on the Raspberry Pi) and the Internet-facing
>> processes.
>> 
>> 	Mel.
>
> I don't understand why you would need a fire door in the first place. 
> At most you are not sinking very much current from a MCU, hardly enough 
> to start a fire. Building a fire door might be a fun project, i.e. temp 
> detection, servo to close off oxygen supply but it is not necessary. I 
> find this typical of the folks who use Linux on VSCDs (Very Small 
> Computing Devices).
>

That isn't what Mel is talking about, but you may have been confused by
him using the word firedoor instead of firewall.

He's clearly worried that if someone managed to compromise the Internet
facing part of his system, then they would own the whole system if he
had combined the GPIO code (which needs privileges) with his Internet
code into one process.

Instead he wants to run the Internet code as unprivileged and communicate
with the privileged code using IPC. As I mentioned in my last post in this
thread, I've never had to do this with a embedded board so I don't know
what other tools are available to him in the versions of Linux shipped
with those boards.

Whenever I build a new Internet facing server as part of my day job I use
a full blown RHEL based system with SELinux running in enforcing mode and
with custom profiles as required. I also lockdown the Internet facing
processes to the minimum required (within reason :-)).

Even with all that, I would still probably seperate the privileged
operations from the unprivileged operations just has he has donw.

Simon.

-- 
Simon Clubley, clubley@remove_me.eisner.decus.org-Earth.UFP
Microsoft: Bringing you 1980s technology to a 21st century world

[toc] | [prev] | [next] | [standalone]

#10860

Mel Wilson wrote:
> Another sighting: Chumby Hacker board <http://www.adafruit.com/products/278>
>
> (This is an old thread, and lots of posts have expired.  Have we already
> talked about this one?)
>
> I start to think that the Linux-based boards are a completely different
> tribe from the smaller processors, and would need a completely different
> treatment.

Not necessarily.

> With a hardware-centric solution I would never be thinking about
> using SysV IPC to put a firedoor between the GPIO-controlling processes
> (which need root privileges on the Raspberry Pi)

Are there the usual insmod/lsmod/rmmod device driver/kernel loadable
modules for the raspberry pi? You should not then need a fire door -
just a device driver.

Nothing wrong with SysV IPC.

> and the Internet-facing
> processes.
>
> 	Mel.
>

--
Les Cargill

[toc] | [prev] | [standalone]

Back to top | Article view | comp.arch.embedded

csiph-web