I know there has been some discussion about Genode and other operating systems (Qubes, Tails, Subgraph) on the secure-os.org mailing list (available via Internet Archive). Again, like @nfeske mentioned, Tor was briefly available in Genode.
It may be easier to handle stream isolation as each application runs as a separate component, so you could handle each one over a different SOCKS port. Although, I am not sure as to the anonymity pros/cons of simply running the Tor process in Genode and using it as a transparent proxy. I am aware that one of the developers of Subgraph mentioned that they needed an application firewall in order to safely handle the torification of generic applications.
We felt that transparent torification is extremely risky without an application firewall,
as many applications may egress naively, exposing the host and the user to a
heightened possibility of interference by active attackers (i.e. MITM by hostile exit
node) or leak identifying user/location/platform/etc information that undermines
Tor and compromises user privacy.
Naive egress over Tor is very risky, this is why the TorBrowser exists. Most
applications were not developed for use over Tor.
Therefore the application firewall is so important that we can’t release an
alpha without it.
I am confused by this. Are you talking about running a separate Tor process, per component that needs to be torified, and then “a strictly isolated network gateway component (Tor-only egress)” that allows Tor traffic from those components specifically out to the Internet? If this is the case, then you should probably just transparent proxy the applications instead, at the “gateway component”. If I have misinterpreted this, please feel free to correct me.
A clear benefit of this approach over something like running a Whonix Gateway VM in Genode, is that the resource consumption would be much lower as you are only running a single, isolated Tor process. This also means that you can easily run multiple copies of Tor simultaneously, avoiding the issues that can arise when funnelling traffic through a single instance of Tor (traffic correlation), without using GBs of RAM to run a whole OS.
However, if we are talking about an “Anonymity-Oriented System”, then the TBB is likely a more important component that needs to arrive in Genode firsthand, before considering generic application proxying. While it is possible to install it into a VM, I would expect to have it natively running in an “Anonymity-Oriented System”.
If so, then you may want to consider other means of achieving anonymity such as Kloak. I think that it would be interesting to introduce a semi-random delay to all keyboard/mouse inputs (maybe via the event filter?), in order to defeat some forms of tracking. It would also be useful to make certain Genode-native components Tor-aware for handling .onion addresses e.g. a Genode depot served over an onion domain.
