5 ms·

Can I recommend using a hypervisor like Xen? While it is technically not an "OS", I find that it offers some of the same security advantages a server-based mic

Can I recommend using a hypervisor like Xen? While it is technically not an "OS", I find that it offers some of the same security advantages a server-based microkernel OSes do. Although DomUs aren't technically privileged userspace processes, it does mitigate the risk of something like a faulty, kludgy mess of a driver taking down an entire system, and while I admit it's not as fancy as something like Mach IPC, it does allow for secure communication between different domains. And on a personal note, as a former GNU/Hurd dev it does make me happy when I find people in the wild with interest in its design :)

ubercow 9y ago
Interesting. I'd love to know more about workflows around a setup like this. Is it possible to use Xen as traditional desktop OS with Keyboard/Mouse/Monitor running X and a Window Manager? Would you run it in a Dom0 or DomU? How would you switch between them, etc.
- stock_toaster 9y ago
  Might be worth looking into QubesOS[1]. It uses Xen to compartmentalize things. Never used it myself though. [1]: https://en.wikipedia.org/wiki/Qubes_OS https://en.wikipedia.org/wiki/Qubes_OS
  - Ojamaflip 9y ago
    I often go back and give Qubes_OS a try but then it lets me down with USB passthrough for a lot of devices I need - not least a USB tethered Internet connection (or USB Networking). It just is so complicated that I gave up and I'll look again when they get to version 4.
- abrookewood 9y ago
  Not sure what the status is now, but many years ago I explored Xen CLient, which runs Xen as the base OS, but lets you run VMs with full hardware support (direct graphics card access etc) as your 'desktop' OS and switch between them. It was originally marketed as a mechanism for running a Corporate OS and a Personal OS simultaneously, with both of them running at within about 5% of native performance.
snvzz 9y ago
Keep in mind Xen is bloated beyond belief, and all of this bloat is running in supervisor mode. It being an actual type 1 hypervisor makes it significantly better than approaches such as Linux KVM or freebsd bhyve, but the TCB is still too big. A better approach is to run the VMM (which handles VM exceptions) as a normal user process under a microkernel. seL4 implements such an approach, with the added benefits of capabilities; the VMM doesn't get any more privileges than it actually needs, thus a successful attack against the VMM from within the VM could not actually provide anything beyond what supervisor mode execution within the VM would. A lot more on this to be found here: https://ts.data61.csiro.au/projects/TS/virtualisation/ https://ts.data61.csiro.au/projects/TS/virtualisation/ More papers (not restricted to virtualization): https://ts.data61.csiro.au/projects/TS/publications.pml https://ts.data61.csiro.au/projects/TS/publications.pml And, while at it, I also recommend reading Gernot Heiser's blog, which has plenty on this. https://microkerneldude.wordpress.com/ https://microkerneldude.wordpress.com/
- xelxebar 9y ago
  Interesting. I my knowledge of hypervisors and virtualization is quite superficial. What makes Xen so bloated? The seL4 kernel has piqued my interest a lot. Though, shamefully, I have to admit the interest isn't backed by many technical reasons. I'm on a vague, pesonal quest to run as minimal a system (both hardware and software) as possible while also keeping things as secure as possible. seL4 hits both those buttons, philosophically. Thanks for the links. This gives some good places to turn my interest into actual knowledge.
  - snvzz 9y ago
    >What makes Xen so bloated? Size, in kLOC, of the hypervisor itself, which runs entirely in supervisor mode and, as such, is part of the TCB.
xelxebar 9y ago
Cool! You're a Hurder! Don't bump into Hurd devs all that often :P I'm kind of sad the L4 port didn't take. The desire to hack on something like that definitely mulls around in the back of my mind. As for the hypervisor idea, another comment mentions QubesOS which I've looked at in the past. This kind of thing does appeal to my "Make Everything Minimal" desire as well as (admittedly vague) concerns about security and isolation.
- joshumax 9y ago
  I use QubesOS at home on a fairly powerful server box and I personally find it quite enjoyable for my usage. Most of the monitors here are hooked up to thin clients with GigE connections to the server. When the server powers on, it automatically starts up the DomUs and configures each one to receive USB events sent from the thin clients. For the display, the server pre-renders the graphics buffer on each domain OS and then sends the resulting frames back to the thin client to display on their respective monitors. After I did this, managing the computers around the house became a whole lot easier considering there was really only 1 major point of failure (the server).
  - sabbay 9y ago
    Could you tell more about your setup? I'd like to do something like this for myself. Maybe some articles or search queries? Is this setup valid for multiple users simultaneously with separate desktops?

ubercow 9y ago

Interesting. I'd love to know more about workflows around a setup like this. Is it possible to use Xen as traditional desktop OS with Keyboard/Mouse/Monitor running X and a Window Manager? Would you run it in a Dom0 or DomU? How would you switch between them, etc.

stock_toaster 9y ago
Might be worth looking into QubesOS[1]. It uses Xen to compartmentalize things. Never used it myself though. [1]: https://en.wikipedia.org/wiki/Qubes_OS https://en.wikipedia.org/wiki/Qubes_OS
- Ojamaflip 9y ago
  I often go back and give Qubes_OS a try but then it lets me down with USB passthrough for a lot of devices I need - not least a USB tethered Internet connection (or USB Networking). It just is so complicated that I gave up and I'll look again when they get to version 4.
abrookewood 9y ago
Not sure what the status is now, but many years ago I explored Xen CLient, which runs Xen as the base OS, but lets you run VMs with full hardware support (direct graphics card access etc) as your 'desktop' OS and switch between them. It was originally marketed as a mechanism for running a Corporate OS and a Personal OS simultaneously, with both of them running at within about 5% of native performance.

snvzz 9y ago

Keep in mind Xen is bloated beyond belief, and all of this bloat is running in supervisor mode. It being an actual type 1 hypervisor makes it significantly better than approaches such as Linux KVM or freebsd bhyve, but the TCB is still too big. A better approach is to run the VMM (which handles VM exceptions) as a normal user process under a microkernel. seL4 implements such an approach, with the added benefits of capabilities; the VMM doesn't get any more privileges than it actually needs, thus a successful attack against the VMM from within the VM could not actually provide anything beyond what supervisor mode execution within the VM would. A lot more on this to be found here: https://ts.data61.csiro.au/projects/TS/virtualisation/ https://ts.data61.csiro.au/projects/TS/virtualisation/ More papers (not restricted to virtualization): https://ts.data61.csiro.au/projects/TS/publications.pml https://ts.data61.csiro.au/projects/TS/publications.pml And, while at it, I also recommend reading Gernot Heiser's blog, which has plenty on this. https://microkerneldude.wordpress.com/ https://microkerneldude.wordpress.com/

xelxebar 9y ago
Interesting. I my knowledge of hypervisors and virtualization is quite superficial. What makes Xen so bloated? The seL4 kernel has piqued my interest a lot. Though, shamefully, I have to admit the interest isn't backed by many technical reasons. I'm on a vague, pesonal quest to run as minimal a system (both hardware and software) as possible while also keeping things as secure as possible. seL4 hits both those buttons, philosophically. Thanks for the links. This gives some good places to turn my interest into actual knowledge.
- snvzz 9y ago
  >What makes Xen so bloated? Size, in kLOC, of the hypervisor itself, which runs entirely in supervisor mode and, as such, is part of the TCB.

xelxebar 9y ago

Cool! You're a Hurder! Don't bump into Hurd devs all that often :P I'm kind of sad the L4 port didn't take. The desire to hack on something like that definitely mulls around in the back of my mind. As for the hypervisor idea, another comment mentions QubesOS which I've looked at in the past. This kind of thing does appeal to my "Make Everything Minimal" desire as well as (admittedly vague) concerns about security and isolation.

joshumax 9y ago
I use QubesOS at home on a fairly powerful server box and I personally find it quite enjoyable for my usage. Most of the monitors here are hooked up to thin clients with GigE connections to the server. When the server powers on, it automatically starts up the DomUs and configures each one to receive USB events sent from the thin clients. For the display, the server pre-renders the graphics buffer on each domain OS and then sends the resulting frames back to the thin client to display on their respective monitors. After I did this, managing the computers around the house became a whole lot easier considering there was really only 1 major point of failure (the server).
- sabbay 9y ago
  Could you tell more about your setup? I'd like to do something like this for myself. Maybe some articles or search queries? Is this setup valid for multiple users simultaneously with separate desktops?