From mboxrd@z Thu Jan 1 00:00:00 1970 From: Harry Butterworth Subject: Re: [PATCH][ACM] kernel enforcement of vbd policies via blkback driver Date: Thu, 27 Jul 2006 18:06:50 +0100 Message-ID: <1154020010.7906.44.camel@localhost.localdomain> References: Mime-Version: 1.0 Content-Type: text/plain Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xensource.com Errors-To: xen-devel-bounces@lists.xensource.com To: Reiner Sailer Cc: Andrew Warfield , xen-devel@lists.xensource.com, xense-devel@lists.xensource.com, Bryan D Payne , ncmike@us.ibm.com List-Id: xen-devel@lists.xenproject.org On Thu, 2006-07-27 at 12:58 -0400, Reiner Sailer wrote: > > > Harry Butterworth wrote on > 07/27/2006 12:36:43 PM: > > > On Thu, 2006-07-27 at 17:26 +0100, Harry Butterworth wrote: > > > > > untrusted driver domain <-> trusted encryption domain <-> > FE-domain > > > hypervisor > > > trusted access control domain > > > > Another argument in favour of this kind of approach is that if your > BE > > is something like a fibrechannel driver for a SAN, there isn't > actually > > any security on the SAN side of it so any guarantees provided by the > > driver domain are pretty much worthless. > > > > Harry. > > > > We are talking about scalable, secure, and efficient local device > virtualization. Even with local devices there is no security on the device side of the device driver. Consider the case of a locally attached sata drive containing 2 partitions, one for each of two domains. It's not unheard of for disk drives to write the data in the wrong place. Or read and return the wrong block. Happens all the time. > > The argumentation for network devices is very different and also > interesting. There is a whole new discussion about how to establish > trust into remote parties. > > Reiner > _______________________________________________ > Xen-devel mailing list > Xen-devel@lists.xensource.com > http://lists.xensource.com/xen-devel