4 ms·
Not if the whole os is a VM in ram, still though, network logging can happen by middleware.
by _8j50 4y ago
Not if the whole os is a VM in ram, still though, network logging can happen by middleware.
- preisschild 4y agoSure you can. For example, with rsyslog you can just send all logs over the network to a logging server (which has disks).
- _8j50 4y agoThat's the network, someone looking at the logs via ssh is also a leak by that logic. Of course!
- deleted 4y ago[deleted]
- matja 4y agoEven without network logging, the hypervisor can still access the memory of the VM, parsing the kernel process and paging structures to read process memory, which can store transient logging information. Things like AMD SEV/SEV-ES are designed to mitigate that aspect, the implementation of which can be proven to end-users of the VM by remote attestation.
- stjohnswarts 4y agoThat's not necessarily the case, vendors have VMs that can spin up with encrypted memory so that only the person spinning them up can see what is in the memory. All AMD and Intel processors have capabilities for this. Just in case you didn't know.