For at least two years, I’ve been talking about how the CHERIoT ABI and compartmentalisation model makes it possible to audit precisely what each compartment is doing. Possible, unfortunately, is not the same as easy. When you link a CHERIoT firmware image, you get a JSON report that details what compartments and threads are in the image and how they can communicate. This can be quite large. For the RTOS test suite, the JSON report is over 200 KiB (significantly larger than firmware image itself). This is JSON, and so can be consumed by pretty much any programming language, but ideally there would be an easy way of writing policies over this kind of thing.

Lobsters is a community-driven platform for sharing and discussing links to articles, tutorials, and projects related to technology and programming. Readers can learn about a wide range of topics, from software development and system administration to cybersecurity and artificial intelligence. With user submissions, comments, and voting, Lobsters provides a platform for collaborative learning and knowledge sharing among technology enthusiasts.

Lobsters

Announcing CHERIoT-Audit, a tool that allows you to write policies in Rego, Open Policy Agent’s policy language. It provides the ability to audit compartments and threads in a JSON report generated by the linker.