User: Password:
Subscribe / Log in / New account

Qubes: security by virtualization

Qubes: security by virtualization

Posted May 7, 2010 1:49 UTC (Fri) by jamesmrh (guest, #31622)
In reply to: Qubes: security by virtualization by pcampe
Parent article: Qubes: security by virtualization

sVirt can't protect against a kernel bug in the host -- if a guest breaks out and exploit a host kernel bug, then it's game over.

We are looking at ways to help mitigate this.

(Log in to post comments)

Qubes: security by virtualization

Posted May 7, 2010 7:50 UTC (Fri) by pcampe (guest, #28223) [Link]

Partially correct, because a MAC could protect against such attack if the MAC function in the kernel is working properly and the policy has no black holes (of course, you could have some kernel bugs that prevent MAC from enforcing the defined security policy when complex interactions between host and guests happen).

Otherwise, you'd better have an hypervisor with a minimal footprint, which at least reduces the attack surface; but Qubes it's using Xen, so it could exposes the same target with the same (known or latent) vulnerabilities.

Copyright © 2017, Eklektix, Inc.
Comments and public postings are copyrighted by their creators.
Linux is a registered trademark of Linus Torvalds