Re:TBray Response: Sun Should Stop Sucking
by tptacek on Friday November 28, 2008 @12:07AM
(#379110)
Let's start with I have a documented security finding in Zones; I'm not sure if it's been published and patched yet, and I'm not pointing it out, but you can track me down on LinkedIn or, I don't know, a lot of other places if you need bona fides.
Then think about the difference between Xen and Zones:
Zones share a kernel.
Xen machines do not.
This has two security implications:
* It is possible for there to be bugs that will allow one zone to see kernel resources (files, sockets, pids, IPC descriptors, etc) from another zone. It is impossible for that to happen with Xen, because VMs don't even know about each other.
* The majority of Solaris (and Linux) kernel vulnerabilities in the last several years have been kernel vulnerabilities, which Zones don't protect you from. The Xen hypervisor is significantly smaller than the Solaris kernel, and has had a far better security track record.
Then think about the difference between Xen and Zones:
Zones share a kernel.
Xen machines do not.
This has two security implications:
* It is possible for there to be bugs that will allow one zone to see kernel resources (files, sockets, pids, IPC descriptors, etc) from another zone. It is impossible for that to happen with Xen, because VMs don't even know about each other.
* The majority of Solaris (and Linux) kernel vulnerabilities in the last several years have been kernel vulnerabilities, which Zones don't protect you from. The Xen hypervisor is significantly smaller than the Solaris kernel, and has had a far better security track record.