Re:Linux kernel use-after-free in Netfilter, local privilege...
by aflag on Wednesday May 10, 2023 @08:03AM
(#35886147)
Hm, if you're making the underlying hardware slower, don't you want the kernel to be even faster though?
Re:Linux kernel use-after-free in Netfilter, local privilege...
by pjmlp on Wednesday May 10, 2023 @10:14AM
(#35887686)
Not when using hypervisor type 1.
Re:Linux kernel use-after-free in Netfilter, local privilege...
by aflag on Wednesday May 10, 2023 @02:10PM
(#35891120)
Why not? Hypervisor type 1 has less overhead, but it's still not quite the same as running directly on the box. I don't think micro kernels would replace those anyway. To be honest, I don't even really see the connection between running most of the kernel in user space and allowing concurrent systems to run in the same hardware.
Re:Linux kernel use-after-free in Netfilter, local privilege...
by snvzz on Friday May 12, 2023 @07:55AM
(#35914881)
seL4 with its VMM is a better hypervisor architecture than, say, Xen.
Xen is unfortunately large, and the full hypervisor runs privileged.
With seL4, VM exceptions are forwarded to VMM, which handles them.
From a security standpoint, a VM escape would only yield VMM privileges, which are no higher than that of the VM itself. This is much better than a compromise of Xen, which would compromise all VMs in the system.
Makatea[0] is an effort to build a Qubes-like system using seL4 and its virtualization support. It is currently funded by a NLNet grant.
All mitigations to achieve microkernel like capabilities.