From mboxrd@z Thu Jan  1 00:00:00 1970
From: Rusty Russell <rusty@rustcorp.com.au>
Subject: Re: Secure KVM
Date: Tue, 08 Nov 2011 09:19:34 +1030
Message-ID: <87ty6fsg3l.fsf@rustcorp.com.au>
References: <1320612020.3299.22.camel@lappy> <877h3cu75a.fsf@rustcorp.com.au> <1320647343.3202.3.camel@lappy>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Cc: Andrea Arcangeli <aarcange@redhat.com>,
	Avi Kivity <avi@redhat.com>,
	Marcelo Tosatti <mtosatti@redhat.com>,
	Ingo Molnar <mingo@elte.hu>, Pekka Enberg <penberg@kernel.org>,
	Cyrill Gorcunov <gorcunov@gmail.com>,
	Asias He <asias.hejun@gmail.com>,
	Anthony Liguori <anthony@codemonkey.ws>,
	"Michael S. Tsirkin" <mst@redhat.com>, kvm <kvm@vger.kernel.org>
To: Sasha Levin <levinsasha928@gmail.com>
Return-path: <kvm-owner@vger.kernel.org>
Received: from ozlabs.org ([203.10.76.45]:33579 "EHLO ozlabs.org"
	rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP
	id S1751897Ab1KHG0Q (ORCPT <rfc822;kvm@vger.kernel.org>);
	Tue, 8 Nov 2011 01:26:16 -0500
In-Reply-To: <1320647343.3202.3.camel@lappy>
Sender: kvm-owner@vger.kernel.org
List-ID: <kvm.vger.kernel.org>

On Mon, 07 Nov 2011 08:29:03 +0200, Sasha Levin <levinsasha928@gmail.com> wrote:
> On Mon, 2011-11-07 at 10:37 +1030, Rusty Russell wrote:
> > On Sun, 06 Nov 2011 22:40:20 +0200, Sasha Levin <levinsasha928@gmail.com> wrote:
> > > The solution is also simple to explain: Split the devices into different
> > > processes and use seccomp to sandbox each device into the exact set of
> > > resources it needs to operate, nothing more and nothing less.
> > 
> > lguest does a process per device.  Actually, it uses clone for legacy
> > reasons, but I have a patch which changes it to processes.
> > 
> > It works well, and it's *simple*.  I suggest looking at
> > Documentation/virtual/lguest/lguest.c.
> > 
> > Good luck!
> > Rusty.
> 
> Yup, thats pretty much what I want to have.
> 
> As you said, clone() isn't really an option - sharing things like the VM
> and handles is something which I want to avoid. How does your patch
> handle IPC?

Yeah, the patch to change it to processes just changes the mmap (of
/dev/zero) which forms guest memory from MAP_PRIVATE to MAP_SHARED.

There's no IPC, because I have no device hotplug :)  On exit we kill the
entire process group, so it kills the device processes too.

Cheers,
Rusty.