The Design and Implementation of the Anykernel and Rump Kernels

B–31
is running on your host. You can also distribute these devices as services on the
network.
On a multiuser machine where you do not have control over how your data is backed
up you can use a cgd server to provide a file system with better confidentiality guarantees
than your regular home directory. You can easily configure your applications
to communicate directly with the cryptographic server, and confidential data will
never hit the disk unencrypted. This, of course, does not protect against all threat
models on a multiuser system, but is a simple way of protecting yourself against one
of them.
Furthermore, you have more fine grained control over privileges. For example, opening
a raw socket requires root privileges. This is still true for a rump server, but
the difference is that it requires root privileges in the rump kernel, not the host
kernel. Now, if rump server runs with normal user privileges (as is recommended),
you cannot use rump kernel root privileges for full control of the hosting OS.
In the end, this document only scratched the surface of what is possible by running
kernel code as services in userspace.