News for hackers. Stuff that matters.

A comment on Unikernels are secure. Parent comment

Re:Unikernels are secure by language on Monday July 10, 2017 @03:37PM (#14738956)
Just like an operating-system executes processes, a VMM executes unikernels. An operating system is responsible for randomizing the layout of processes in memory. Shouldn't the actual question here be "Does my hypervisor implement some mechanism for randomizing the layout of my unikernel?"
[ Parent | on HN ]
Re:Unikernels are secure by wmf on Monday July 10, 2017 @04:31PM (#14739375)
I don't think it matters whether it's implemented by the hypervisor or the unikernel since it's all open source. But for compatibility with existing hypervisors/clouds one could imagine a boot loader that loads the main unikernel at a random address, sets up page tables with NX, and then makes a one-way transition to ring 3 so that the page tables cannot be modified.
[ Parent | on HN ]
Re:Unikernels are secure by language on Monday July 10, 2017 @05:27PM (#14739851)
> one could imagine a boot loader that loads the main unikernel at a random address, sets up page tables with NX, and then makes a one-way transition to ring 3

True - I suppose I'm trying to hold onto the "kernel:hypervisor :: process:unikernel" analogy here for no good reason. Following it suggested that it might be the hypervisor's responsibility.

[ Parent | on HN ]