Walsh: Secure Virtualization Using SELinux (sVirt)
Walsh: Secure Virtualization Using SELinux (sVirt)
Posted Aug 24, 2009 21:29 UTC (Mon) by caitlinbestler (guest, #32532)Parent article: Walsh: Secure Virtualization Using SELinux (sVirt)
Using SELinux to protect the Hypervisor is decidedly the wrong approach
unless you are using a large bloated hypervisor (such as Windows or Linux).
unless you are using a large bloated hypervisor (such as Windows or Linux).
A more productive approach to security would be to have a small, stable
kernel(Hypervisor) and disaggregate the backend device drivers into
separate domains.
Yes, the single hypervisor is still an avenue of attack, but so is
the BIOS. Both achieve security by being small and stable rather than
jury rigging trip-wires all over.
The LWN site is currently under high scraper load, so comment display has been suppressed for anonymous users. If you are a human, you may read the comments by clicking the button below:
Note: you can avoid this step in the future by logging into your LWN account.