3 ms·
Just another iteration in the constant cycle of adding abstractions. What's another layer?
by duaneb 11y ago
Just another iteration in the constant cycle of adding abstractions. What's another layer?
- nickpsecurity 11y agoThe benefit was explained in an early, secure-virtualization project: http://www.cse.psu.edu/~trj1/cse543-f06/papers/vax_vmm.pdf http://www.cse.psu.edu/~trj1/cse543-f06/papers/vax_vmm.pdf Allows easier enforcement of isolation-based policies, easier verification of TCB, compatibility with existing OS/applications/tools, and optional debugging of above OS. Attempts to build secure UNIX's totally failed because it was inherently insecure in so many ways and took many API modifications. Many VM's, separation kernels, etc were built with strong security. Abstraction helps if applied correctly.