8 ms·
OpenBSD vmm enabled
- notaplumber 10y agoAnd of course, being OpenBSD, it's privsep and sandboxed from the very beginning.. cool. https://marc.info/?l=openbsd-cvs&m=144702840931345&w=2 https://marc.info/?l=openbsd-cvs&m=144702840931345&w=2, https://marc.info/?l=openbsd-cvs&m=147578652321303&w=2 https://marc.info/?l=openbsd-cvs&m=147578652321303&w=2 Man pages: http://man.openbsd.org/vmm.4 http://man.openbsd.org/vmm.4 http://man.openbsd.org/vmd.8 http://man.openbsd.org/vmd.8, http://man.openbsd.org/vm.conf.5 http://man.openbsd.org/vm.conf.5 http://man.openbsd.org/vmctl.8 http://man.openbsd.org/vmctl.8
- rwmj 10y agoQEMU/KVM on Fedora and RHEL uses seccomp, SELinux, namespaces and a separate user, and has done for about the past 5 years. It's more interesting if they've managed to fully protect the kernel part of this (ie. vmm on OpenBSD, KVM on Linux) from the rest of the kernel.
- JoachimSchipper 10y agoI'm not clear - do you want to protect the vmm driver in the host from attacks started by the rest of the host kernel? Or are you referring to attacks started by the guest on the http://man.openbsd.org/virtio.4 http://man.openbsd.org/virtio.4 interface? OpenBSD's VMs seem to be pledge()d to not call most host-side kernel interfaces...
- rwmj 10y agoI'm referring to a mistake in the kernel module corrupting some other in-kernel structures, especially if that can be triggered from guest code.
- 4ad 10y agoThere is no privilege separation between kernel modules. They all run in the same address space with the same CPU privilege. SELinux, seccomp, and all that protect a compromised user space thread in the host (responsible for running emulated guests, or one that provides virtual device support to guests) from other user space threads (other VMs). If there is a some problem in the KVM kernel module that stomps over memory, SELinux and seccomp can't do anything about it.
- rwmj 10y agoRight, exactly the point I made up-thread (https://news.ycombinator.com/item?id=12700045 https://news.ycombinator.com/item?id=12700045).
- brynet 10y agoOpenBSD has no kernel modules, everything compiled into the GENERIC kernel is expected to be using proper kernel interfaces, mucking around with kernel structures is a no-no. Nothing can really prevent driver bug causing a crash, this isn't a microkernel, but it can reduce exposure from userland, i.e: pledge restrictions on syscalls/ioctls/sysctls.
- snvzz 10y agoHowever, it is still a boring type-2 hypervisor, just like bhyve, vmware or kvm; no real progress whatsoever. I'm keeping an eye at seL4's VMM support, it looks promising, with the microkernel actually guaranteeing isolation, whereas the VMM runs with minimum privileges as a user process.
- bcook 10y agoNo progress? Perhaps that is true from a general virtualization perspective, but this is progress from an OpenBSD (virtualization) perspective, right?
- andreiw 10y agoVMware ESXi is a Type 1 hypervisor.
- allanjude 10y agoIs it really though? It is running on top of a stripped down version of Redhat.
- yellowapple 10y agoNo it's not. Once upon a time, ESXi (when it was still called ESX) shipped with a stripped-down Linux in a role similar to a Dom0 on Xen; nowadays, ESXi doesn't even use Linux in that capacity.
- ysleepy 10y agoSurprised that it's not a port of bhyve. I also found some slides from the authors of vmm/vmd: http://bhyvecon.org/bhyvecon2016-Mike.pdf http://bhyvecon.org/bhyvecon2016-Mike.pdf http://bhyvecon.org/bhyvecon2016-Reyk.pdf http://bhyvecon.org/bhyvecon2016-Reyk.pdf (found on https://wiki.freebsd.org/bhyve https://wiki.freebsd.org/bhyve)
- notaplumber 10y agobhyvecon was held at the same time as AsiaBSDcon, Mike Larkin & Reyk Flöter were invited to speak. I think OpenBSD vmm/vmd was announced around the same time, so it became an informal "BSD virtualization" event. Mike's original announcement of virtualization support answered the 'why' regarding porting another hypervisor, but honestly for something as security critical as this, I'm glad they took their time to design something for OpenBSD's needs. https://marc.info/?l=openbsd-tech&m=144104398132541&w=2 https://marc.info/?l=openbsd-tech&m=144104398132541&w=2
- ams6110 10y agoOpenBSD and FreeBSD diverged long enough ago that a port might not be straightforward, or in alignment with the objectives of the project.
- derefr 10y agoBigger things have been ported across wider gaps. Illumos has a "port" of Linux's KVM!
- 0xcde4c3db 10y agoJust to get out in front of this, as someone who is a quasi-fan of OpenBSD: yes, Theo had a scathing rant years ago about virtualization being terrible [1]. But it should be noted that that was well before virtualization on x86 was mature, and in response to an assertion that the use of VMs would increase security. [1] https://marc.info/?l=openbsd-misc&m=119318909016582 https://marc.info/?l=openbsd-misc&m=119318909016582
- sverige 10y agoI know people like to point out Theo's "rants" for some reason (that was nine years ago, for goodness' sake), but is it a rant, or is it just unvarnished truth delivered in a style that is more concerned with truth than people's precious feelings? I've read a lot of Theo's emails in the lists, and frankly I find it refreshing that he says what he thinks. And what I really find refreshing is that he gives a shit about whether code is correct, secure, and readable. There's a lot of lip service to those goals, but OpenBSD actually works really hard to deliver it with not a lot of money and precious little thanks. Now, what was inaccurate about his assessment of VM from nine years ago that wasn't true? Or is it just that he seems so darn mean?
- riffraff 10y ago> I find it refreshing that he says what he thinks. you can rephrase that email in a nicer way, while still expressing what you think. For example, you can drop the first paragraph, and no information is lost. You can also remove "if not stupid" and the informational content stays the same. I am an OpenBSD fan in many ways, but you can generally express what you think while still being kind.
- geocar 10y agoI don't always agree. Rhetoric has a lot of forms that are useful tools in argument, and while we will not admonish someone for asking "have you stopped beating your wife yet" (or in this case, "Virtualization seems to have a lot of security benefits.") we are too quick to ignore the very valid point in response because it wasn't friendly enough. Derailing the conversation that way prevents us from dealing with what I think is the bigger issue: When someone says something stupid like "have you stopped beating your wife" (or "Virtualization seems to have a lot of security benefits"), we may need to tell them it is stupid, because stupidity has this way of spreading when it sounds nice and helpful (yes, beating your wife is bad; yes security benefits are good), but it's still a stupid statement. Virtualization is extremely popular, but it isn't secure, and it's actually (and when you're thinking clearly, obviously) less secure than other, existing systems. Security has to be a complete holistic effort, and not an abstraction layer, which is something most people in our industry ignore. Calling out someone as stupid for saying stupid things seems to me to be the best defence, after all, you're not going to convince them that they're stupid, but you might convince someone else.
- ams6110 10y agoFrom the thread: Currently this is limited to Intel hosts. We would like to get AMD also supported, but that requires some more work. Still very cool -- happy to have an option other than qemu.
- sigjuice 10y agoWill this run nested inside VMWare Fusion? I don't have a spare computer to try this out.
- dijit 10y agotypically not, once you use a virtualisation instruction on the CPU it cannot be passed to the guests. Nested virtualisation typically uses emulation without hardware acceleration.
- wila 10y agoHyper-V runs under Fusion, Qubes OS and Xen also work. Have not tested others, but this is one area where Fusion excels. Yes it will be slower, but for testing the concept that is usually fine.
- sigjuice 10y agoI needed Xen for some experimentation. I had trouble running alpine-xen-3.4.4 in Fusion. XenServer 7 seems to work in Fusion, but I don't like it. I finally managed to get alpine-xen running inside KVM (Ubuntu 16.04) inside Fusion.
- bonzini 10y agoYou only need to emulate the virtualization instructions. KVM does this and pretty much everyone else does too.
- mrweasel 10y agoI don't see why you couldn't parse the virtualisation instruction to a virtual machine. Modern hyper-visors don't emulate the CPU instructions any more, they're parsed through to the virtual machine. While I'm certainly not sure, I do believe that at least some virtualisation solutions are able to parse the virtualisation instructions from the host CPU to the guest.
- phessler 10y agoif VMWare Fusion provides the Virtualization features to the guest, then yes. If not, no. But then again, that is true for all VM-nested software.