Code & Beer #12 Chromium OS Introduction https://code-beer.hackpad.com/WtAf9qA1qOx#:h=#12-Chromium-OS-Introduction

1. AZ Huang <aitjcize@gmail.com>
Chromium OS

3. What is Chromium OS?
Chromium OS

5. Features
● Fast booting (only on Chromebook ;)
○ Boot within 5 seconds!
○ Customized firmware + bootloader:
■ Firmware(i.e. BIOS): coreboot
■ Bootloader: depthcharge
● Simple and Safe:
○ Security: browser sandbox + verified boot
● Based on Gentoo
● Has keyboard!

6. Security: Web Apps?
● Chrome extensions:
○ Pure HTML5
○ With NaCl: Native Client binary
■ Sandboxed environment
■ Small performance overhead
● Android Apps?

7. ARC: App Runtime for Chrome
● Currently only supports for apps (officially):
○ Duolingo - A fun and free way to learn a new
language before your next trip
○ Evernote - Write, collect and find what matters to
you, with a full-size keyboard and touchscreen
○ Sight Words - A delightful way for you to help
improve your child's reading skills
○ Vine - Create short, beautiful, looping videos in a
simple and fun way

8. ARC: App Runtime for Chrome
● Hack: vladikoff/chromeos-apk
○ Run other Apps on Windows/Linux/MacOS

9. Security
● But every piece of software has bugs …
○ Browser loopholes?
○ Sandbox is penetrated?
● OS modified, data stolen...

10. Security: Verified Boot
● How can I prevent firmware/filesystem/kernel
being modified by malware?
RO
firmware
(root key)
RW
firmware
Verifies
Kernel Filesystem
Verifies Verifies

11. Security: Filesystem Verifying
● Linux: dm-verity

12. Security: Verified Boot
● What if firmware / kernel / filesystem actually
got modified?
● Have a duplicate of everything!!
Filesystem
A
Kernel
A
RW
firmware
A
RO
firmware
Kernel
B
RW
firmware
B
Filesystem
B
Boot
Boot

13. Security: Verified Boot
● With verified boot, filesystem is read-only?
What about user data?
○ Stateful partition
Filesystem
A
Kernel
A
Stateful partition
(stores user data)
Filesystem
B
Kernel
B
Filesystem
C
Kernel
C
Reserved, not
used for now
OEM
Encrypted

14. Security: A copy of everything?
● Benefits:
○ AU(Auto update) can be done in another copy.
○ If AU failed, we can always fallback to the previous
version.
Filesystem
A
Kernel
A
Filesystem
B
Kernel
B
Currently
Booting
AU
Becomes default at next boot
Boot failed?
fall back to the previous version

15. Boot Priority

16. Physical Security
● What if someone grab your device, can he
read the files (browser cache/bookmarks…)?
● Stateful partition is encrypted
○ Key stored in TPM
● TPM: Trusted Platform Module:
○ Preventing firmware version rollback
○ Store user data encryption keys
○ Protect certain RSA keys

17. Hacking Chromium OS
● Crouton: Chromium OS Universal Chroot
Environment
○ Run Ubuntu(chroot) on Chromebook!

18. Hacking Chromium OS
● Chrbuntu:
○ Booting with ChromeOS kernel + any rootfs
○ You still need kernel modules under /lib/modules ;)
○ http://chromeos-cr48.blogspot.fr/
○ http://askubuntu.com/questions/356243/true-ubuntu-
on-chromebook-arm-samsung

19. Hacking Chromium OS
● Chromium OS SDK:
○ A Gentoo chroot environment
● Become a chromium OS developer!
○ http://www.chromium.org/chromium-os
○ http://chromium-review.googlesource.com

20. Thank you!