Walsh: Secure Virtualization Using SELinux (sVirt)

It's the perfect kernel from a security standpoint. Something with nearly
zero functionality has about zero chance of ever having a security
problem!!

To do anything with it you have to run Linux on top of it... which gets you
what, exactly? A system with nearly zero hardware support running a
application environment that is less secure and has less performance then
if you just ran it on bare hardware.

-------------------

And that goes pretty much the same for "lightweight" hypervisor like Xen or
ESX.

Lets look at Xen.(I am much more familiar with Xen, but I am sure that ESX
is in a similar situation)

In order to run anything you have to take a Linux kernel, shove it up into
Ring 1 and then have your hypervisor run in Ring0.

So.. theoretically you might have some security improvements, but in
practice the Linux environment needed for you to do anything and it has
pretty much full access to your hardware and all your guests. (anybody ever
heard of a term called "DMA"?)

Sooo.. in fact your _worse_ off. Because now your not just dealing with the
Xen hypervisor your dealing with all the code that is in Linux kernel and
then all the code that is required for the hardware emulation and I/O
virtualization and all that stuff.

And Xen is no featherweither either. 300k LoC I think.

So your "lightweight" hypervisor solution weighs in at about 2-3 times
amount of code running on your system to get the same work done as just
running Linux on the bare metal.

-------

To get rid of the dependence on Linux your going to have to write hardware
drivers, create a sort of userland interface, and then all the code
neccassry for management and I/O redirection/emulation and all that...

So now your hypervisor is essentially a Linux competitor and is huge, or
you have vastly reduced feature set.

You can't get away from the fact that if you want to support hardware and
have similar functionality that you get from a kernel your essentially just
going to have to write a kernel eventually. You can call it a hypervisor,
but a rose by any other name will require about the same amount of
functionality.

Meanwhile the "heavyweight" KVM code that turns Linux into a hypervisor is
what? 30k? 50k? If you want to go by LoC that is actually quite a bit less
then is required by Xen.

---------------

People need to get the idea out of their heads that virtualization can
increase security. This is a flawed way of looking at it.

The ideal solution is to have separate machines for each service you want
to deploy. But that is expensive. Virtualization can reduce costs.. and
that is the best way to look at it, I figure. VM's are a cost cutting
thing, not a security thing. When you can not afford to do the security
right (or at least the best way) then you use virtualization.

> The evolution of seL4 is continuing within NICTA, and it is the basis of ongoing research activities here at NICTA. However, it is also the subject of commercialisation activities, and thus is currently proprietary. We are endeavouring to release seL4 in the future, but the time-line and exact nature of the release is yet to be decided.

Thanks, but no thanks. There are already plenty of other free microkernels out there (L4, Mach, Coyotos, HURD, Minix, etc.)