3 ms·

"You don't have to rebuild your image with Debian patches or anything like that since the kernel is minimal and unique. And exploits have minimal impact in any

"You don't have to rebuild your image with Debian patches or anything like that since the kernel is minimal and unique. And exploits have minimal impact in any case." This isn't correct. If there is a bug in the unikernel library you are building into your unikernel you can still exploit it. Imagine if there is a DHCP parsing error in the networking stack which can lead to Remote Code Execution. Or imagine if there's a deserialization error in a web framework which can lead to remote code execution (RCE). Or In both cases you need to follow the upstream and rebuild the unikernel. Additionally, I think that unikernels are less secure if anything. If you break into the application you are already in kernel mode and can access any file or privilege resources belonging to the unikernel. Also, there is no hope for defense in depth techniques like sandboxing or resource brokers. With a normal application you would need to do some sort of privilege escalation or sandbox escape after hacking the application.

externalreality 8y ago
The kernel is small so security patches and such will be less frequent and there are minimal utilities like ssh, shell, what have you. Also, the key is that there is very little to exploit so the likely hood of it being exploited is reduced.
- muricula 8y ago
  I'm all for attack surface reduction, but little to exploit is not nothing to exploit. Your shell, sshd, and networking stack have probably all been exploited many times.
  - externalreality 8y ago
    > Your shell, sshd, and networking stack have probably all been exploited many times. Yes, I've exploited them myself with script-kiddy tools. Its not hard. Remember those your average libos application may not have any of those things (if not only an simple IP stack).
gdy 8y ago
"can access any file or privilege resources belonging to the unikernel" What resources?
- muricula 8y ago
  Network sockets, files, capabilities, any sort of privilege checked object the kernel supplies. It depends on the OS.
  - gdy 8y ago
    Well, why do you call them privileged? Privileged compared to what? There is only one application and the kernel lib's only purpose is to serve it.

externalreality 8y ago

The kernel is small so security patches and such will be less frequent and there are minimal utilities like ssh, shell, what have you. Also, the key is that there is very little to exploit so the likely hood of it being exploited is reduced.

muricula 8y ago
I'm all for attack surface reduction, but little to exploit is not nothing to exploit. Your shell, sshd, and networking stack have probably all been exploited many times.
- externalreality 8y ago
  > Your shell, sshd, and networking stack have probably all been exploited many times. Yes, I've exploited them myself with script-kiddy tools. Its not hard. Remember those your average libos application may not have any of those things (if not only an simple IP stack).

gdy 8y ago

"can access any file or privilege resources belonging to the unikernel" What resources?

muricula 8y ago
Network sockets, files, capabilities, any sort of privilege checked object the kernel supplies. It depends on the OS.
- gdy 8y ago
  Well, why do you call them privileged? Privileged compared to what? There is only one application and the kernel lib's only purpose is to serve it.