24 ms·

Native OpenBSD hypervisor hits -current

170 points by eatonphil 11y ago

api 11y ago
Make it clean and fast and you'll have a compelling secure host OS for VMs. One problem that would be good to address (and maybe it is) is making it really hard to dump the memory of a VM. We don't have homomorphic encryption yet, so right now if you dump a VM you own any secrets it holds. So at the very least this should be made as hard as possible on production VM hosts.
- jodrellblank 11y ago
  right now if you dump a VM you own any secrets it holds Unrelated to OpenBSD but related to VM security from administrators - https://4sysops.com/archives/shielded-vms-in-windows-server-2016-hyper-v/ https://4sysops.com/archives/shielded-vms-in-windows-server-...
  - tyho 11y ago
    This is not very useful, it is a security policy change. The previous post mentioned homomorphic encryption. This is a method of performing computation on the cipher text. If this were implemented, then you could potentially create VM's where even in the event of a hypervisor compromise, dumping the plaintext memory of guests is not possible. If you can take a memory dump of the host sytem, you can from that devise the encryption key for the disk encryption with the M$ solution to this issue.
    - deleted 11y ago
      [deleted]
- x0x0 11y ago
  What does making it hard for the host to dump vm memory buy you? It seems like if the host wants, there's virtually endless things they can do. iow, you have to trust the host.
  - doomrobo 11y ago
    Agreed. If you own the host, you win. The point is to make it difficult to own the host from within the VM, not vice-versa.
    - ams6110 11y ago
      If I'm running a guest on a hosting service, I'd like it if I didn't have to trust the host. Technically, that's maybe not possible right now, but it's not like it's a goal we should just shrug off.
      - doomrobo 11y ago
        I don't think that will ever be possible, barring some sort of quantum memory where reading clobbers data.
        toast0 11y ago
        To be pedantic, reading dram does clobber the data; but it gets re written as part of the read cycle.
  - api 11y ago
    Things are not insecure or secure. Things are secure to varying degrees; nothing is perfectly so and few things are totally not. (... and anyone who claims anything is totally secure is delusional.) Making it hard buys you some resistance to less skilled attackers. Since skill tends to obey a power law distribution, this is most attackers. Make it as hard as possible and you get more and more protection from more and more attackers, and so on. Your average attacker doesn't know enough to bust out x86 assembly language to inject root code into the kernel and dump a VM's RAM. So make it so you have to do this, and you've ruled out your average attacker. The average attacker will only 'dd' the VMs' disks, which if they've encrypted data at rest will not get them the crown jewels. But make it easy to dump VM RAM and you've exponentially increased the damage from the average attacker (due to power law distribution of skill).
- alphonse23 11y ago
  homomorphic encryption exists. It's just slow, though it depends on what you consider slow: https://github.com/shaih/HElib https://github.com/shaih/HElib
- mkj 11y ago
  There's Intel SGX which give secure enclaves through hardware, could probably do unreadable VMs.
  - amluto 11y ago
    No, or at least not in the traditional sense. SGX is strictly CPL 3, i.e. user mode. You could plausibly stick a unikernel inside.
    - mkj 11y ago
      Oh I'd missed that, thanks. Maybe uclinux...? Or qemu - more nesting!
hackuser 11y ago
Why isn't OpenBSD more widely used? I only know what I read about it, but: * If I was building a system where UI and broad hardware and software compatibility weren't an issue (for example, if I were building an appliance or IoT device), an exceptionally secure, stable, reliable, open, well-maintained and well-documented OS would be wonderful. * If I was building a Unix server with those specs, why not? * Why aren't Google's, Amazon's, Yahoo's, etc. server farms running on OpenBSD? How about iOS? (Android needs broad hardware compatibility.) Are there essential power or system features that Linux or FreeBSD has and OpenBSD lacks? As it's not that widely used, I suspect there are considerations or problems I'm overlooking, or maybe the advantages aren't as large as I think. It's hard to believe it's all politics or personality conflicts.
- zdw 11y ago
  I've been deploying OpenBSD in production since the 2.x days (late 90's, an example machine was a recycled 486 with a PCI and ISA 10Mbit/s ethernet cards). While it's possible to use OpenBSD as a general purpose server or desktop, that's not where it's strength lies. It tends to excel as a firewall or router for the under 1Gbit/s crowd that has Unix sysadmin experience - basically, appliance applications where it would function in the same role as a Cisco or Juniper router device. OpenBSD's leadership has a goal of pushing the security envelope, and force positive change on the rest of the Unix ecosystem, which it's succeeded in doing in many ways.
  - ams6110 11y ago
    I've used it as my main work desktop for years.
    - geofft 11y ago
      What web browser are you running, and what's its security story?
      - ams6110 11y ago
        Chrome and Firefox. I also play with Xombrero (based on Webkit), but though I like it a lot from a feature standpoint, it's the least stable of the three. None are as stable as their Linux or Windows counterparts.
shiftoutbox 11y ago
When should we expect this to run on bitrig ?
- stock_toaster 11y ago
  Has bitrig seen much uptake? Genuinely curious. I remember reading about it when it was started, but haven't heard much about it lately.
  - mrweasel 11y ago
    I don't know about the uptake, but I have seen patches making their way back to OpenBSD from BitRig.
    - ben_bai 11y ago
      Have looked it up once, for me Bitrig is about better ARM support and using LLVM. Both desirable. Am I still correct? Am I missing something?
      - pyvpx 11y ago
        dropping "obscure" platforms and git rounds it out.
nickpsecurity 11y ago
Good to see they finally compromised on this. A few more here and there we might see OpenBSD start getting more traction. They can maintain their quality difference if they make the right compromises rather than every compromise. Interesting to see what choices they make from here.
- chrismsnz 11y ago
  Is this really a compromise? OpenBSD has happily run as a guest for a long time now, with various virtio drivers being added some time ago. Solutions like virtualbox and xen reach far into the system and are still a no-go on OpenBSD. vmm on the other hand is a very literal OpenBSD implementation of a hypervisor. Minimal cruft means very little device emulation, virtio support only etc... The code is simple and readable[1], as opposed to other monstrosities. I would take a punt and guess that the reason OpenBSD hasn't had a hypervisor is that a) all of the current solutions were inappropriate, and b) nobody had the time/effort to implement an appropriate one. [1] http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/sys/arch/amd64/amd64/vmm.c?rev=1.3&content-type=text/x-cvsweb-markup http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/sys/arch/amd64/...
  - hga 11y ago
    Well, there's this famous 2007 statement by Theo de Raadt that many took to mean OpenBSD would never, ever play this game: https://marc.info/?l=openbsd-misc&m=119318909016582 https://marc.info/?l=openbsd-misc&m=119318909016582
    - farhaven 11y ago
      Many people with amazing selective reading abilities :)
      - hga 11y ago
        Eh, I think you're being overly harsh. He expresses strong disdain for the whole concept on the x86 platform, and it's not unreasonable to extrapolate that to a "this is such a bad idea, so dangerous that we won't supply such an inherently broken thing".
brynet 11y ago
Here's the original announcement, with answers to a few frequent questions. http://marc.info/?l=openbsd-tech&m=144104398132541&w=2 http://marc.info/?l=openbsd-tech&m=144104398132541&w=2
geggam 11y ago
I run Linux at work because I have to. I run OpenBSD on my personal servers and deskstops/laptops because I like it. This is really good news because now I can move my VM host to OpenBSD. OpenBSD is a clean simple user friendly OS.

170 points by eatonphil 11y ago

api 11y ago

Make it clean and fast and you'll have a compelling secure host OS for VMs. One problem that would be good to address (and maybe it is) is making it really hard to dump the memory of a VM. We don't have homomorphic encryption yet, so right now if you dump a VM you own any secrets it holds. So at the very least this should be made as hard as possible on production VM hosts.

jodrellblank 11y ago
right now if you dump a VM you own any secrets it holds Unrelated to OpenBSD but related to VM security from administrators - https://4sysops.com/archives/shielded-vms-in-windows-server-2016-hyper-v/ https://4sysops.com/archives/shielded-vms-in-windows-server-...
- tyho 11y ago
  This is not very useful, it is a security policy change. The previous post mentioned homomorphic encryption. This is a method of performing computation on the cipher text. If this were implemented, then you could potentially create VM's where even in the event of a hypervisor compromise, dumping the plaintext memory of guests is not possible. If you can take a memory dump of the host sytem, you can from that devise the encryption key for the disk encryption with the M$ solution to this issue.
  - deleted 11y ago
    [deleted]
x0x0 11y ago
What does making it hard for the host to dump vm memory buy you? It seems like if the host wants, there's virtually endless things they can do. iow, you have to trust the host.
- doomrobo 11y ago
  Agreed. If you own the host, you win. The point is to make it difficult to own the host from within the VM, not vice-versa.
  - ams6110 11y ago
    If I'm running a guest on a hosting service, I'd like it if I didn't have to trust the host. Technically, that's maybe not possible right now, but it's not like it's a goal we should just shrug off.
    - doomrobo 11y ago
      I don't think that will ever be possible, barring some sort of quantum memory where reading clobbers data.
      - toast0 11y ago
        To be pedantic, reading dram does clobber the data; but it gets re written as part of the read cycle.
- api 11y ago
  Things are not insecure or secure. Things are secure to varying degrees; nothing is perfectly so and few things are totally not. (... and anyone who claims anything is totally secure is delusional.) Making it hard buys you some resistance to less skilled attackers. Since skill tends to obey a power law distribution, this is most attackers. Make it as hard as possible and you get more and more protection from more and more attackers, and so on. Your average attacker doesn't know enough to bust out x86 assembly language to inject root code into the kernel and dump a VM's RAM. So make it so you have to do this, and you've ruled out your average attacker. The average attacker will only 'dd' the VMs' disks, which if they've encrypted data at rest will not get them the crown jewels. But make it easy to dump VM RAM and you've exponentially increased the damage from the average attacker (due to power law distribution of skill).
alphonse23 11y ago
homomorphic encryption exists. It's just slow, though it depends on what you consider slow: https://github.com/shaih/HElib https://github.com/shaih/HElib
mkj 11y ago
There's Intel SGX which give secure enclaves through hardware, could probably do unreadable VMs.
- amluto 11y ago
  No, or at least not in the traditional sense. SGX is strictly CPL 3, i.e. user mode. You could plausibly stick a unikernel inside.
  - mkj 11y ago
    Oh I'd missed that, thanks. Maybe uclinux...? Or qemu - more nesting!

hackuser 11y ago

Why isn't OpenBSD more widely used? I only know what I read about it, but: * If I was building a system where UI and broad hardware and software compatibility weren't an issue (for example, if I were building an appliance or IoT device), an exceptionally secure, stable, reliable, open, well-maintained and well-documented OS would be wonderful. * If I was building a Unix server with those specs, why not? * Why aren't Google's, Amazon's, Yahoo's, etc. server farms running on OpenBSD? How about iOS? (Android needs broad hardware compatibility.) Are there essential power or system features that Linux or FreeBSD has and OpenBSD lacks? As it's not that widely used, I suspect there are considerations or problems I'm overlooking, or maybe the advantages aren't as large as I think. It's hard to believe it's all politics or personality conflicts.

zdw 11y ago
I've been deploying OpenBSD in production since the 2.x days (late 90's, an example machine was a recycled 486 with a PCI and ISA 10Mbit/s ethernet cards). While it's possible to use OpenBSD as a general purpose server or desktop, that's not where it's strength lies. It tends to excel as a firewall or router for the under 1Gbit/s crowd that has Unix sysadmin experience - basically, appliance applications where it would function in the same role as a Cisco or Juniper router device. OpenBSD's leadership has a goal of pushing the security envelope, and force positive change on the rest of the Unix ecosystem, which it's succeeded in doing in many ways.
- ams6110 11y ago
  I've used it as my main work desktop for years.
  - geofft 11y ago
    What web browser are you running, and what's its security story?
    - ams6110 11y ago
      Chrome and Firefox. I also play with Xombrero (based on Webkit), but though I like it a lot from a feature standpoint, it's the least stable of the three. None are as stable as their Linux or Windows counterparts.

shiftoutbox 11y ago

When should we expect this to run on bitrig ?

stock_toaster 11y ago
Has bitrig seen much uptake? Genuinely curious. I remember reading about it when it was started, but haven't heard much about it lately.
- mrweasel 11y ago
  I don't know about the uptake, but I have seen patches making their way back to OpenBSD from BitRig.
  - ben_bai 11y ago
    Have looked it up once, for me Bitrig is about better ARM support and using LLVM. Both desirable. Am I still correct? Am I missing something?
    - pyvpx 11y ago
      dropping "obscure" platforms and git rounds it out.

nickpsecurity 11y ago

Good to see they finally compromised on this. A few more here and there we might see OpenBSD start getting more traction. They can maintain their quality difference if they make the right compromises rather than every compromise. Interesting to see what choices they make from here.

chrismsnz 11y ago
Is this really a compromise? OpenBSD has happily run as a guest for a long time now, with various virtio drivers being added some time ago. Solutions like virtualbox and xen reach far into the system and are still a no-go on OpenBSD. vmm on the other hand is a very literal OpenBSD implementation of a hypervisor. Minimal cruft means very little device emulation, virtio support only etc... The code is simple and readable[1], as opposed to other monstrosities. I would take a punt and guess that the reason OpenBSD hasn't had a hypervisor is that a) all of the current solutions were inappropriate, and b) nobody had the time/effort to implement an appropriate one. [1] http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/sys/arch/amd64/amd64/vmm.c?rev=1.3&content-type=text/x-cvsweb-markup http://cvsweb.openbsd.org/cgi-bin/cvsweb/src/sys/arch/amd64/...
- hga 11y ago
  Well, there's this famous 2007 statement by Theo de Raadt that many took to mean OpenBSD would never, ever play this game: https://marc.info/?l=openbsd-misc&m=119318909016582 https://marc.info/?l=openbsd-misc&m=119318909016582
  - farhaven 11y ago
    Many people with amazing selective reading abilities :)
    - hga 11y ago
      Eh, I think you're being overly harsh. He expresses strong disdain for the whole concept on the x86 platform, and it's not unreasonable to extrapolate that to a "this is such a bad idea, so dangerous that we won't supply such an inherently broken thing".

brynet 11y ago

Here's the original announcement, with answers to a few frequent questions. http://marc.info/?l=openbsd-tech&m=144104398132541&w=2 http://marc.info/?l=openbsd-tech&m=144104398132541&w=2

geggam 11y ago

I run Linux at work because I have to. I run OpenBSD on my personal servers and deskstops/laptops because I like it. This is really good news because now I can move my VM host to OpenBSD. OpenBSD is a clean simple user friendly OS.