From mboxrd@z Thu Jan  1 00:00:00 1970
From: Anthony Liguori <anthony@codemonkey.ws>
Subject: Re: Secure KVM
Date: Mon, 07 Nov 2011 13:07:09 -0600
Message-ID: <4EB82C5D.9080909@codemonkey.ws>
References: <1320612020.3299.22.camel@lappy> <4EB7A45D.1030600@redhat.com> <4EB817D2.5010200@codemonkey.ws> <4EB826E1.8010106@redhat.com>
Mime-Version: 1.0
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Cc: Sasha Levin <levinsasha928@gmail.com>,
	Andrea Arcangeli <aarcange@redhat.com>,
	Marcelo Tosatti <mtosatti@redhat.com>,
	Ingo Molnar <mingo@elte.hu>, Pekka Enberg <penberg@kernel.org>,
	Cyrill Gorcunov <gorcunov@gmail.com>,
	Asias He <asias.hejun@gmail.com>,
	Rusty Russell <rusty@rustcorp.com.au>,
	"Michael S. Tsirkin" <mst@redhat.com>, kvm <kvm@vger.kernel.org>
To: Avi Kivity <avi@redhat.com>
Return-path: <kvm-owner@vger.kernel.org>
Received: from mail-gx0-f174.google.com ([209.85.161.174]:54479 "EHLO
	mail-gx0-f174.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org
	with ESMTP id S1752645Ab1KGTHO (ORCPT <rfc822;kvm@vger.kernel.org>);
	Mon, 7 Nov 2011 14:07:14 -0500
Received: by ggnb2 with SMTP id b2so5589789ggn.19
        for <kvm@vger.kernel.org>; Mon, 07 Nov 2011 11:07:13 -0800 (PST)
In-Reply-To: <4EB826E1.8010106@redhat.com>
Sender: kvm-owner@vger.kernel.org
List-ID: <kvm.vger.kernel.org>

On 11/07/2011 12:43 PM, Avi Kivity wrote:
> On 11/07/2011 07:39 PM, Anthony Liguori wrote:
>>> One thing to beware of is memory hotplug.  If the memory map is static,
>>> then a fork() once everything is set up (with MAP_SHARED) alllows all
>>> processes to access guest memory.  However, if memory hotplug is
>>> supported (or planned to be supported), then you can't do that, as
>>> seccomp doesn't allow you to run mmap() in confined processes.
>>>
>>> This means they have to use RPC to the main process in order to access
>>> memory, which is going to slow them down significantly.
>>
>>
>> If you treat the sandbox as ephemeral by leveraging save/restore, you
>> can throw away and rebuild the device model on every memory change.
>> While not a super cheap operation, it's at least amortized over time.
>
> Good idea!
>
> We lost the context of all threads, but that also happens on live
> migration.  I'm sure this is workable.
>
> Plus we get save/restore testing for free.  Did someone say win/win?

Indeed.

But it mandates that everything in the sandbox be serializable so given the 
current state of things, it would mean you couldn't put qcow2 in the sandbox, 
for instance.

Regards,

Anthony Liguori