4 ms·
Well, it's not just the KVM attack surface -- it's KVM + QEMU, and there have emphatically been escapes. Yes, the shared kernel is an issue -- but so is a shar
by bcantrill 4y ago
Well, it's not just the KVM attack surface -- it's KVM + QEMU, and there have emphatically been escapes. Yes, the shared kernel is an issue -- but so is a shared hypervisor or a shared CPU. It's a risk to be mitigated, and it's a gross exaggeration to say that it "isn't safe for multitenant untrusted workloads."
- tptacek 4y agoIt's QEMU for you, or was at the time, but I'm not talking about what the right engineering decision is in 2015, I'm talking about what makes sense today, with memory-safe hypervisors. For untrusted multitenant workloads in 2022, for arbitrary code and without a language-level sandbox, a shared-kernel workload isolation system might be malpractice. Again: you can easily rattle off the LPEs that would have broken a Linux shared-kernel scheme (of any realistic sort) over the last couple years. Someone else dunked on you for a Joyent bug from a bunch of years ago. I didn't. Security researchers were dunking on shared-kernel isolation even back then, but it was a much harder decision back when the only alternative was expensive, memory-unsafe legacy hypervisors, and I would have had a hard time weighing guest escape vs kernel LPE back then too. But this time and the last time we bounced off each other on this, we weren't talking about 2015; we're talking about today, when there are multiple memory-safe hypervisor options. I don't think it's an open question anymore.
- bcantrill 4y agoI don't think we're really comparing hardware virtualization to OS-based virtualization (we at Oxide run HW-based virt inside of OS-based virt so that's a bit of a false dichotomy to begin with), but rather whether or not it's "malpractice" (your term) to run a multitenant workload on illumos zones. And to be clear: we're not talking about Linux here; we're talking about illumos -- for which OS-based virtualization has an entirely different design center. (And indeed, a design center that was -- from the beginning -- designed for securing multitenant workloads.) So your experiences with Linux are of limited relevance here, frankly.