Re: Fw: Xen on /. again

[Jacob Gorm Hansen <jacobg@diku.dk>]

Trent Jaeger wrote:

> - isolation boundaries cost more than you might think, but computers are 
> a lot faster now (10X+)
> - we need mandatory access control interface like LSM to have flexible 
> control of resources (rather than dump resources to a control partition)
> - authorize access at bind time rather than at use time (no critical 
> path impact)

Is there any reason to allow communication between VMs, other than 
driver access? It seems to me you can just use network communication 
(potentially signed or encrypted) when you need to communicate, and that 
anything else would violate the fundamental 'virtual machine' abstraction?

Also, I suppose you will wish to prevent covert channels between 
domains, e.g. domains communicating using various timing attacks (I move 
the disk head to the other end of the disk if I wish to tell you 
something), or by allocating/freeing certains parts of memory.

How much will you need to dumb down the VMs view of what is going on in 
the machine to achieve this (not expose real time information, not 
expose real page tables), and how much of a VMM will there be left when 
you are done?

best regards,
Jacob


-------------------------------------------------------
This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time
by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl