4 ms·

Zones increase attack surface compared to a hypervisor because you have a shared kernel, and every syscall is a potential attack surface. Compare that to a hype

Zones increase attack surface compared to a hypervisor because you have a shared kernel, and every syscall is a potential attack surface. Compare that to a hypervisor, which a much simpler API exposed with far less functionality. Hypervisor vulnerabilities are far less common than kernel vulnerabilities for that reason. This is fairly well known in the security space. In fact, if you look into Joyent, you'll see they don't use regular zones for multi-tenancy, but rather a KVM-inspired hypervisor implementation of zones.

Annatar 9y ago
This is cookamamie. A hypervisor also has syscalls and in this particular case the global zone is the hypervisor. They even call it "type 1 hypervisor". Apropos "KVM-inspired hypervisor": the zones still function in exactly the same way as they did when I first used them in 2006; in fact when running lx and KVM Joyent is exploiting an obscure capability called a brand (branded zones), but that capability has always been there, since day one back in 2006. Finally, there has only been one known case of managing to break out of a zone and this was through a kernel driver exposed to it, exactly the kind of scenario you'd have on VMware. In the decade since, there have been no known cases, so not only is your argumentation cookamamie, it's in the realm of pure hypothesis.
solarengineer 9y ago
SmartOS provides Zones, and if you need it a KVM instance within a Zone. Hypervisors have their own security issues. They're just programs. That's why there've been all the patching over the years for Xen and for KVM. Last year, an independent researcher did find an issue related to Dtrace that Joyent patched. However, the security and engineering that backs Zones is way more than with other kernels. https://www.joyent.com/blog/dtrace-conf-16-wrap-up https://www.joyent.com/blog/dtrace-conf-16-wrap-up DTrace exploitation: http://slides.com/benmurphy/deck#/ http://slides.com/benmurphy/deck#/ http://benmmurphy.github.io/blog/2017/01/06/arbitrary-kernel-memory-reads-on-illumos/ http://benmmurphy.github.io/blog/2017/01/06/arbitrary-kernel... https://vimeo.com/173300650 https://vimeo.com/173300650

Annatar 9y ago

This is cookamamie. A hypervisor also has syscalls and in this particular case the global zone is the hypervisor. They even call it "type 1 hypervisor". Apropos "KVM-inspired hypervisor": the zones still function in exactly the same way as they did when I first used them in 2006; in fact when running lx and KVM Joyent is exploiting an obscure capability called a brand (branded zones), but that capability has always been there, since day one back in 2006. Finally, there has only been one known case of managing to break out of a zone and this was through a kernel driver exposed to it, exactly the kind of scenario you'd have on VMware. In the decade since, there have been no known cases, so not only is your argumentation cookamamie, it's in the realm of pure hypothesis.

solarengineer 9y ago

SmartOS provides Zones, and if you need it a KVM instance within a Zone. Hypervisors have their own security issues. They're just programs. That's why there've been all the patching over the years for Xen and for KVM. Last year, an independent researcher did find an issue related to Dtrace that Joyent patched. However, the security and engineering that backs Zones is way more than with other kernels. https://www.joyent.com/blog/dtrace-conf-16-wrap-up https://www.joyent.com/blog/dtrace-conf-16-wrap-up DTrace exploitation: http://slides.com/benmurphy/deck#/ http://slides.com/benmurphy/deck#/ http://benmmurphy.github.io/blog/2017/01/06/arbitrary-kernel-memory-reads-on-illumos/ http://benmmurphy.github.io/blog/2017/01/06/arbitrary-kernel... https://vimeo.com/173300650 https://vimeo.com/173300650