3 ms·
That's not entirely true in practice. I'm currently playing with rump kernels deployed on top of seL4's hypervisor to give my platform the security posture of a
by im_down_w_otp 9y ago
That's not entirely true in practice. I'm currently playing with rump kernels deployed on top of seL4's hypervisor to give my platform the security posture of a unikernel inside the security posture of seL4 VM isolation.
You could potentially compromise the rump kernel, but you still wouldn't be able to break out of the VM's isolation context.
- tscs37 9y agoThe app is still compromised. On top of that, you didn't get to reap the benefits of any of the protections you get from a proper Kernel like Ring 3 execution, NX bits on pages, guard pages on the stack, etc.