12 ms·
A native hypervisor is coming to OpenBSD
- nickpsecurity 11y agoGood to see OpenBSD in process of getting one. I previously thought that OpenBSD, or at least Theo, hated virtualization based on this rant: http://www.tylerkrpata.com/2007/10/theo-de-raadt-on-x86-virtualization.html http://www.tylerkrpata.com/2007/10/theo-de-raadt-on-x86-virt... Or just x86's virtualization. Nothing different popped in my news feed until now. Has OpenBSD's position changed on the subject of virtualization? And is there a more recent post that explains their position?
- DArcMattr 11y agoTheo is objecting to the view that VMs are a security necessity.
- wcfields 11y agoAren't they though? With 0-days it makes sense to be able to snapshot non mission-critical systems, bring them offline, until a patch is found. Snapshotting alone is a security necessity when patching too. Very easy to rollback to a "good" state.
- metalliqaz 11y agoI haven't read it, but I assume the discussion was about sandboxing clients. From that perspective, any additional security would be defeated as soon as a client is able to affect the hypervisor or the host OS. So (according to Theo) if you can't write a secure host and/or client, the VM doesn't improve security.
- yellowapple 11y agoWhile I agree with him on a lot of things, this isn't one of them; security is all about layers, and it's not like OpenBSD hasn't steered clear of other forms of sandboxing (like chroots and systrace). This doesn't mean that virtualization should be relied on exclusively or even near-exclusively as a defense (which is what I suspect Theo was more objecting to, along with the point of "well if you can't write a secure operating system, what makes you think you can write a secure hypervisor?"), but rather that it should be used as an additional layer on top of (or rather, underneath) a bunch of others. It's like bulkheads on modern ships. Yeah, if you get a hole in your hull, you're gonna be in some (literally) deep water, but that bulkhead (so long as it's built right) could mean the difference between limping to the nearest harbor or sinking to the nearest seafloor.
- tedunangst 11y agoSomehow back when Amazon had to reboot every EC2 server to fix a Xen bug, my "insecure" hypervisor-less server didn't require such action. I think I'll prefer to keep sailing without that particular bulkhead.
- metalliqaz 11y agoYou've never had to reboot your server?
- Sanddancer 11y agoThe reboots were because Amazon cuts a lot of corners in their Xen setup because instances are supposed to be "disposable". A proper VM cluster would use dedicated storage nodes that export over something like iscsi, which would require just transferring a memory snapshot, or would use the native, slower, disk snapshotting migration. But that's just one of many ways AWS is rather broken from an operations standpoint.
- oblio 11y agoThing is, the AWS philosophy of considering everything short of data sources "disposable" leads to a lot more robust engineering. Yes, it makes Ops work more difficult, but as someone smart said regarding software: if something hurts, you're not going it often enough :)
- yellowapple 11y agoI'm pretty sure "if something hurts, you're not doing it often enough" doesn't apply to, say, arm-breakage or self-immolation :)
- ownagefool 11y agoWhat you call a proper VM cluster has been pretty terrible from my experience as both a developer on an early cloud and a consumer of large government facing clouds. Typically the network or SAN becomes oversaturated and the vm's shit the bed. AWS on the other hand was considerably more reliable and I'd argue they've made better decisions rather than cut corners.
- MichaelGG 11y agoSnapshotting is sorta orthogonal to virtualization though, isn't it? Just snapshot at the storage level, no?
- Sanddancer 11y agoKVM, VMware, and Xen all allow you to do a snapshot of memory as well as of disk. It's one of the tools used to migrate xen instances between nodes, for example.
- feld 11y agoand why can't you do that with containers or jails? or filesystem snapshots? or instant re-deploy to a known good state from ansible/puppet/salt/chef? Just because there's a nice mouse-navigable GUI for entry level Windows admins doesn't mean it's a good solution. if you need snapshots for doing updates it's because your software is fragile, undocumented, and you don't have a deployment procedure. Fix that, and upgrades will be easy and not scary.
- travem 11y agoOr you could have a consistent repeatable way of doing it across multiple apps and operating systems. I am not averse to your argument that doing it at the app level has benefits, but being able to do it at the VM level in a consistent way is going to be simpler when you expand beyond a handful of applications.
- forgottenpass 11y agoI agree that there is convenience to the execution controls VMs provide. But if you can't repeatably and easily stand up a replacement/duplicates of a system from configuration management and backups, then you don't actually have configuration management or backups.
- travem 11y agoSure, to be clear I'm not arguing against those things, I'm just arguing that VM level snapshots and clones are also a tool in the operational arsenal and is in fact a very popular one that works well in practice.
- forgottenpass 11y agoIt looks like I agree entirely with you, just not the guy that started this whole thread by saying VMs are a security necessity.
- nickpsecurity 11y agoMakes sense. I disagree with him in that they can definitely have benefit over regular OS for security. The reason is relative simplicity and ability to easily integrate security tech in versus a whole OS with legacy compatibility issues. This was proven in KVM/370, then VAX Security Kernel, then MILS, then Nizza Security Architecture, and then people started leveraging Xen for similar reasons albeit without the same assurance. The NSA's pentesters repeatedly failed to breach some of these despite years of effort while the OS's... see Snowden leaks and TAO catalog. Of course, I agree that VM's aren't necessary: one of many approaches one can use and don't get the job done by themselves. They are beneficial, though, as running security-critical components on a 4-12Kloc in kernel mode with mediated, simple interface should have way less impact than running it on 1Mloc+ with POSIX-style interface.
- yellowapple 11y agoTheo's more recent talks (like that one for ruBSD) seem to indicate that OpenBSD's looking to prioritize virtualization in order to stay competitive with other operating systems. It's also worth noting that OpenBSD has supported virtualization on some other platforms, too; for example, it can be used to manage SPARC logical domains (LDOMs).
- nickpsecurity 11y agoAppreciate it. Makes sense on competitiveness. Didn't know about the LDOM support. Interesting.
- ben_bai 11y agoThat E-Mail is from 2007... This is from 2013: https://youtu.be/OXS8ljif9b8?t=395 https://youtu.be/OXS8ljif9b8?t=395
- nickpsecurity 11y ago"That E-Mail is from 2007..." Yes, people have repeated that line since 2008. Readers certainly saw the timestamp. It was main Q&A and search result, though. Hence asking for modern post. "This is from 2013" And that's a start. Appreciate the link. I don't see many of his interviews but that was the first one I saw him admit to being behind. Good they're changing their attitude a bit. The expected and somewhat disappointing part is when he has no answer to what can be done to raise the bar past a few exploit mitigations. There's something like four decades of work (and worked examples) showing how to increase assurance of security in hardware, software, and systems. Especially in capability, microkernels, static analysis, covert channel analysis, and so on. He could... idk... apply some of that instead of mock and ignore it like most mainstream does. FreeBSD is ahead here with SEBSD and Capsicum work. One project did port OpenBSD to L4 kernel to isolate it in a protection domain. The idea, as in Nizza Security Architecture, is to be able to split system into legacy, untrusted stuff in VM and trusted, highly-assured components running directly on microkernel. A proven model that would benefit OpenBSD by dramatically reducing attack surface. This is done in embedded space (eg INTEGRITY, PikeOS Hypervisor) for up to 8 ISA's each for those wondering about portability. Just one of dozens of techs to draw on to increase assurance. Will be interesting to see if they draw on any of this or get left behind [again] by those that do.
- tedunangst 11y agoThe OpenBSD covert channel analysis team is understaffed at the moment.
- nickpsecurity 11y agoBoth EROS and Genode managed to do a lot of what I mentioned with less staff & time. Plus, with solid architecture that above components can leverage without doing all the highly assured stuff over and over again: what I call security ROI. Your huge TCB, drivers probably in kernel, and language-related issues are where I predicted most of the trouble would come from. (Did it?) Something like Nizza Security Architecture would benefit you along with interface checks you're already good at and a better language that translates to C with checks automatically inserted. Far as covert channels, Google Kemmerer's Shared Resource Matrix for a method that worked for amateurs and pro's alike on a budget. Any person handling a subsystem can apply it. Even using it on function call level can tell you a lot. If understaffed, just use it on any component handling secrets for storage and timing channels. Best bang for buck.
- 0x0 11y agox86 hardware support for virtualization has changed quite a bit since 2007, though. https://en.wikipedia.org/wiki/X86_virtualization#Intel_virtualization_.28VT-x.29 https://en.wikipedia.org/wiki/X86_virtualization#Intel_virtu...
- nickpsecurity 11y agoTrue. Looks to have gotten a lot better, too.
- BrainInAJar 11y agoGreat to see more competition for kvm & FreeBSD's bhyve
- metalliqaz 11y agoAnd Xen :) NetBSD runs it well
- pyvpx 11y agoarguable. Xen has become more and more Linux-centric and there seemingly has been less and less interest in the NetBSD developer community to keep abreast. see stub-domains
- notabot 11y agoAs far as I can tell the in-tree QEMU-traditional stubdomain is not tied to Linux. Maybe you mean the effort to make Linux-based upstream QEMU stubdomain? That solution is not merged upstream. And there is alternative proposal called rump kernel based upstream QEMU stubdomain, which is not tied to any OS. In fact open source Xen is becoming less and less Linux-centric. There is ongoing work to make FreeBSD Dom0. Arguably there are still much work to do, but at least they're making progress.
- justinsaccount 11y agohttps://marc.info/?l=openbsd-misc&m=119318909016582 https://marc.info/?l=openbsd-misc&m=119318909016582 From: Theo de Raadt > Virtualization seems to have a lot of security benefits. You've been smoking something really mind altering, and I think you should share it. x86 virtualization is about basically placing another nearly full kernel, full of new bugs, on top of a nasty x86 architecture which barely has correct page protection. Then running your operating system on the other side of this brand new pile of shit. You are absolutely deluded, if not stupid, if you think that a worldwide collection of software engineers who can't write operating systems or applications without security holes, can then turn around and suddenly write virtualization layers without security holes. You've seen something on the shelf, and it has all sorts of pretty colours, and you've bought it. That's all x86 virtualization is.
- brynet 11y agoA mailing list post from 8 years ago. And a lot of virtualization implementations have had security issues. I don't think that precludes an attempt at getting it right in OpenBSD.
- atmosx 11y ago> [...] an attempt at getting it right in OpenBSD. So... The others got it wrong, and you're gonna get it right! :-) How do you justify the 1.3% share on servers[1]? There must be something GNU/Linux got right! There's not even a mention of OpenBSD[2], just Free and Net. People must be stupid, right? :-) [1] http://w3techs.com/technologies/details/os-unix/all/all http://w3techs.com/technologies/details/os-unix/all/all [2] http://w3techs.com/technologies/details/os-bsd/all/all http://w3techs.com/technologies/details/os-bsd/all/all
- ascendantlogic 11y agoOpenBSD (collectively) has made a career out of getting it "right" where other people have not re: security. They've had their own missteps but that doesn't mean they shouldn't give it a try.
- walterbell 11y agoIn addition to a new VMM, why not enable OpenBSD to run as a guest VM on AWS/Xen?
- tedunangst 11y agoIndeed. Why not?
- walterbell 11y agoThis March 2015 post lists some known work items, http://www.joelroberts.org/openbsd/ http://www.joelroberts.org/openbsd/ - Kernel hangs when bringing online additional cpus--no working SMP - PV drivers for net and disk needed. Probably easy to take from NetBSD - System needs testing for stability An old (2012?) comparison of 4 BSDs on Xen and KVM: https://gmplib.org/~tege/virt.html https://gmplib.org/~tege/virt.html
- jrelsasser 11y agoI believe that Xen SMP hang was fixed in 5.8: http://comments.gmane.org/gmane.os.openbsd.cvs/143877 http://comments.gmane.org/gmane.os.openbsd.cvs/143877
- dfsfcv 11y agoFrom the link above comparing BSDs on Xen: "OpenBSD probably works poorly by design, since its lead developer despises virtualisation." I have seen this before. Can someone summarise the reasons why Theo de Raadt hates virtualisation?
- wmf 11y agoBasically he thinks any hypervisor that isn't OpenBSD is not secure. "x86 virtualization is about basically placing another nearly full kernel, full of new bugs, on top of a nasty x86 architecture which barely has correct page protection. Then running your operating system on the other side of this brand new pile of shit." http://marc.info/?l=openbsd-misc&m=119318909016582 http://marc.info/?l=openbsd-misc&m=119318909016582 (I see justinsaccount already posted this below.)
- hapless 11y agoI wonder how reusable this will be on the SPARC64 port. There was never enough interest in Linux/SPARC to make a Xen or KVM port feasible. But OpenBSD's community is a different animal.
- avsm 11y agoOpenBSD/sun4v already has some support for virtualisation via logical domains. See: http://www.openbsd.org/papers/eurobsdcon2011-kettenis.pdf http://www.openbsd.org/papers/eurobsdcon2011-kettenis.pdf and the ldomctl manpage here: http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man8/sparc64/ldomctl.8?query=ldomctl&arch=sparc64 http://www.openbsd.org/cgi-bin/man.cgi/OpenBSD-current/man8/...
- makmanalp 11y agoIf you don't mind me asking, I've always wondered - what do you / people use SPARC for?
- zdw 11y agoTesting - per the desired hardware page: http://www.openbsd.org/want.html http://www.openbsd.org/want.html "It is important to spread sparc64 around the development community, since it is the most strict platform for detecting non-portable or buggy code."
- hapless 11y agofor me, personally, it's perverse historical interest. in a larger sense, it's because Oracle's support policies make the market-clearing price for used SPARC hardware very, very reasonable. The value of 3-year-old SPARC gear is essentially $1. As a real Solaris/SPARC customer, it's cheaper to buy new than try to get a piece of used equipment into Oracle's good graces.
- tbirdz 11y agoIf you don't mind me asking, where are you finding such cheap SPARC hardware? Even 5-year old hardware still goes for thousands of dollars on the second-hand market.
- ananomouse 11y agoWas doing some digging into the research. Perhaps someone happens to have a copy of Bill Broadley's 2007 IT Security Symposium presentation/paper? It was hosted at http://shell.cse.ucdavis.edu/~bill/virt/virt.pdf http://shell.cse.ucdavis.edu/~bill/virt/virt.pdf
- anw 11y agohttp://www.lugod.org/presentations/virt-lugod.pdf http://www.lugod.org/presentations/virt-lugod.pdf and http://taviso.decsystem.org/virtsec.pdf http://taviso.decsystem.org/virtsec.pdf These seem to be the most popular ones that show up.
- Animats 11y agoUnclear what this means. Is this a hypervisor that runs under OpenBSD? Or a hypervisor under which OpenBSD runs? Or an attempt to kludge OpenBSD into a hypervisor? Or some kind of Docker-like container system for OpenBSD?
- justincormack 11y agoHypervisor that runs under openbsd, and which can run openbsd.
- rwmj 11y ago"For example, I've been baking in support for things that the other implementations don't care about (namely i386 support, shadow paging, nested virtualization, support for legacy peripherals, etc) and trying to backfit support for those things into another hypervisor would probably have been just as hard as building it from the ground up." I don't get it. qemu does all of that already. All he needs to do is implement the same kernel ioctls for OpenBSD that KVM implements on Linux, and he gets all of that for free.
- stsp 11y agoqemu runs as a userspace process so it is relatively slow. Essentially, vmm is to OpenBSD what KVM is to Linux. And yes, a KVM compatible interface can be built, as Mike mentioned.
- throwaway7767 11y agoSo, is this thing going to run all the IO emulation in the kernel? That sounds like a horrible architecture security-wise, very much not what I would have expected from OpenBSD, which always seemed to pick security over performance. By far most security bugs in modern hypervisors come from bugs in the emulation of legacy devices, because it's complicated and messy. This is why for example Red Hat's hypervisor solution has had a lot of work put into isolating the qemu process with SELinux.
- deleted 11y ago[deleted]