4 ms·

Yes, of course you can only exploit a bug if it exists :) However, all code has bugs (including security-critical ones). Minimising the attack surface of trust

Yes, of course you can only exploit a bug if it exists :) However, all code has bugs (including security-critical ones). Minimising the attack surface of trusted elements is an important part of defense-in-depth. Xen is <150000 LoC, and a lot of that can be run in less-trusted stub domains. The linux kernel runs in the millions of lines (admittedly probably not all compiled-in, but it's still at least an order of magnitude more), and none of it can be fenced away from the sensitive bits. I'm not saying containers don't have their place. But there are benefits to full VMs in security critical infrastructure.

Retric 12y ago
No Zen is ~150,000 LoC more than every OS + application it's hosting. If any of them have a significant bug someone can get inside your network. Put another way Zen can have bugs which make you venerable even if your OS and application where rock solid, but it does not add anything over simply running different applications on different physical hardware.
- throwaway7767 12y ago
  But a bug in the OS will bite you whether you are using containers, VMs or physical servers, so it's not very relevant to the discussion. When comparing the security of containers to VMs, vulnerabilities in the OS should be out of scope. A more realistic attack scenario would be a virtual host or container server with two VMs/containers: a trusted on and an untrusted one. Assume neither has networking, but the untrusted one is running compromised software. The question is how easy is it to escalate privileges from the untrusted container/VM to the trusted one? I'd say that Xen's small code size and resulting easier auditing is a benefit here.
  - deleted 12y ago
    [deleted]
walterbell 12y ago
More on the small attack surface of Xen: http://www.slideshare.net/xen_com_mgr/lfnw2014-advanced-security-features-ofxenproject http://www.slideshare.net/xen_com_mgr/lfnw2014-advanced-secu...

Retric 12y ago

No Zen is ~150,000 LoC more than every OS + application it's hosting. If any of them have a significant bug someone can get inside your network. Put another way Zen can have bugs which make you venerable even if your OS and application where rock solid, but it does not add anything over simply running different applications on different physical hardware.

throwaway7767 12y ago
But a bug in the OS will bite you whether you are using containers, VMs or physical servers, so it's not very relevant to the discussion. When comparing the security of containers to VMs, vulnerabilities in the OS should be out of scope. A more realistic attack scenario would be a virtual host or container server with two VMs/containers: a trusted on and an untrusted one. Assume neither has networking, but the untrusted one is running compromised software. The question is how easy is it to escalate privileges from the untrusted container/VM to the trusted one? I'd say that Xen's small code size and resulting easier auditing is a benefit here.
- deleted 12y ago
  [deleted]

walterbell 12y ago

More on the small attack surface of Xen: http://www.slideshare.net/xen_com_mgr/lfnw2014-advanced-security-features-ofxenproject http://www.slideshare.net/xen_com_mgr/lfnw2014-advanced-secu...