Re: [PATCH][ACM] kernel enforcement of vbd policies via blkback driver

[Harry Butterworth <harry@hebutterworth.freeserve.co.uk>]

On Thu, 2006-07-27 at 12:58 -0400, Reiner Sailer wrote:
> 
> 
> Harry Butterworth <harry@hebutterworth.freeserve.co.uk> wrote on
> 07/27/2006 12:36:43 PM:
> 
> > On Thu, 2006-07-27 at 17:26 +0100, Harry Butterworth wrote:
> > 
> > > untrusted driver domain <-> trusted encryption domain <->
> FE-domain
> > >                            hypervisor
> > >                    trusted access control domain
> > 
> > Another argument in favour of this kind of approach is that if your
> BE
> > is something like a fibrechannel driver for a SAN, there isn't
> actually
> > any security on the SAN side of it so any guarantees provided by the
> > driver domain are pretty much worthless.
> > 
> > Harry.
> > 
> 
> We are talking about scalable, secure, and efficient local device
> virtualization.  

Even with local devices there is no security on the device side of the
device driver.  Consider the case of a locally attached sata drive
containing 2 partitions, one for each of two domains.  It's not unheard
of for disk drives to write the data in the wrong place.  Or read and
return the wrong block.  Happens all the time.

> 
> The argumentation for network devices is very different and also
> interesting. There is a whole new discussion about how to establish
> trust into remote parties. 
> 
> Reiner
> _______________________________________________
> Xen-devel mailing list
> Xen-devel@lists.xensource.com
> http://lists.xensource.com/xen-devel