Re: Fw: [Xen-devel] Xen on /. again

[Steven Hand <Steven.Hand@xxxxxxxxxxxx>]

>Mark Williamson wrote:
>>>Also, I suppose you will wish to prevent covert channels between
>>>domains, e.g. domains communicating using various timing attacks (I move
>>>the disk head to the other end of the disk if I wish to tell you
>>>something), or by allocating/freeing certains parts of memory.
>>>
>>>How much will you need to dumb down the VMs view of what is going on in
>>>the machine to achieve this (not expose real time information, not
>>>expose real page tables), and how much of a VMM will there be left when
>>>you are done?
>> 
>> Well domains are not aware of each other's memory usage, so I wouldn't have 
>> thought that allocation / exposing real page tables would matter.  (Except 
>> dom0 can of course see everything if it wants).
>
>Information about other domains' memory usage is leaked via the
>hardware->physical mapping.

Unprivileged domains cannot see each others hardware->physical mappings. 
If we use full shadow mode (either with or without VT-x), domains cannot
even see their own hardware->physical mappings. 

Explicit page reuse (via either network page-flipping or balloon drivers) 
can be eliminated, albeit at a cost to performance. Networking can still
be provided by using either multiple NICs or hardware virtualization in 
the NIC (somewhat like the arseNIC work we did a few years back). Allowing
networking of course has other well-known risks (see below). 

>> Timing related attacks are somewhat trickier to eliminate covert channels in
>> although some randomisation can limit the bandwidth.
>
>Eliminating covert channels is completely infeasible. I don't see any
>value in aiming for this. It's not a useful security property in most
>circumstances.

Well in the current version of Xen, there are plenty of non-covert channels 
(like network connections and raw shared memory event channels) which probably 
make more sense to look at first :-) 

I think received wisdom is that it's certainly very difficult (and 
very expensive in terms of time and, usually, performance) to eliminate 
all covert channels. It may also be impossible depending on requirements
(e.g. if one allows networked connections to arbitrary third parties). 
The full virtualization support in VT may be useful though. 


cheers, 

S.



-------------------------------------------------------
This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time
by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl
_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxxx
https://lists.sourceforge.net/lists/listinfo/xen-devel