Re: Secure KVM

[Anthony Liguori <anthony@codemonkey.ws>]

On 11/07/2011 12:43 PM, Avi Kivity wrote:
> On 11/07/2011 07:39 PM, Anthony Liguori wrote:
>>> One thing to beware of is memory hotplug.  If the memory map is static,
>>> then a fork() once everything is set up (with MAP_SHARED) alllows all
>>> processes to access guest memory.  However, if memory hotplug is
>>> supported (or planned to be supported), then you can't do that, as
>>> seccomp doesn't allow you to run mmap() in confined processes.
>>>
>>> This means they have to use RPC to the main process in order to access
>>> memory, which is going to slow them down significantly.
>>
>>
>> If you treat the sandbox as ephemeral by leveraging save/restore, you
>> can throw away and rebuild the device model on every memory change.
>> While not a super cheap operation, it's at least amortized over time.
>
> Good idea!
>
> We lost the context of all threads, but that also happens on live
> migration.  I'm sure this is workable.
>
> Plus we get save/restore testing for free.  Did someone say win/win?

Indeed.

But it mandates that everything in the sandbox be serializable so given the 
current state of things, it would mean you couldn't put qcow2 in the sandbox, 
for instance.

Regards,

Anthony Liguori