4 ms·
You are probably talking about this: https://research.nccgroup.com/wp-content/uploads/2020/07/ncc_group-assessing_unikernel_security.pdf https://research.nccgro
by eyberg 4y ago
You are probably talking about this: https://research.nccgroup.com/wp-content/uploads/2020/07/ncc_group-assessing_unikernel_security.pdf https://research.nccgroup.com/wp-content/uploads/2020/07/ncc...
In short - not a fundamental limitation - just that kernels (even if they are small) have a ton of work that goes into them. Nanos for instance has page protections, ASLR, virtio-rng (if on GCP), etc.
- OrvalWintermute 4y agoI thought that presentation was a little like looking at a hobby OS of a type, then attempting to draw security conclusions for all of that type. The NanoVMs unikernel for example, is pretty small, DoD supported, and has: ASLR Stack Randomization Heap Randomization Library Randomization Executable Randomization Page Protections Stack Execution off by Default Heap Execution off by Default Null Page is Not Mapped Stack Cookies/Canaries Rodata no execute Text no write STIG