[Kata-hypervisor] kata requirements for image formats and devices

Allison Randal allison at lohutok.net
Mon Aug 6 14:22:27 UTC 2018


On 08/06/2018 11:01 AM, Dr. David Alan Gilbert wrote:
> 
> Can I ask you what your main security worries with them are?

Virtual machines were a pretty neat idea back in the day when security
was just getting started on "Hey, now that we can run more than one
process on the machine at the same time, maybe we shouldn't give every
process complete and unrestricted control over the entire machine" (for
example http://doi.acm.org/10.1145/800122.803961, from 1973).

But, computer security has evolved in the past 60 years, and virtual
machines haven't really kept up. There's plenty of research on how to
make virtual machines more secure, but it isn't making its way into
stable implementations. This is partly for the practical reason that
it's time-consuming and expensive to update a large codebase, but it's
also partly because the "improvements" often come with performance
trade-offs that make virtual machines unusable. Just a few examples out
of thousands:

https://doi.org/10.1145/3193111.3193118
https://doi.org/10.1145/3134600.3134648
https://doi.org/10.1109/TDSC.2015.2429132
https://doi.org/10.1109/TIFS.2015.2505680
https://doi.org/10.1145/2517488.2517489
https://www.usenix.org/conference/atc17/technical-sessions/presentation/gopalan


While containers aren't currently considered very secure either (e.g.
https://doi.org/10.1109/i-Society.2016.7854163,
https://doi.org/10.1145/3058060.3058085), the isolation that containers
do provide is a collection of features added to more modern kernels
(namespaces, cgroups, capabilities, seccomp, etc), in a modular approach
that has allowed containers to more readily adopt existing advances in
security, and also means containers can more easily pivot to incorporate
new low-level security features that become available in the future.
Which makes it interesting to explore low-level isolation features
exposed directly to libcontainer (and similar).

Doing secure isolation without virtualization isn't a radical new idea,
the earliest work on capabilities for secure process isolation started
several years before the first work on virtual machines (for some of the
earliest history, see https://homes.cs.washington.edu/~levy/capabook/).
There are a number of independent threads of research heading this
direction in recent years, here are a few examples:

https://www.usenix.org/conference/hotcloud18/presentation/williams
https://doi.org/10.1145/3078861.3078882
https://doi.org/10.1145/3102980.3103008
https://doi.org/10.1145/3086567.3086572
https://doi.org/10.1109/DSN.2017.49


This isn't a criticism of the Kata project. In terms of what you can
download and install in production today, virtual machines wrapped
around containers are a reasonable option, and certainly fairly common
practice. And, since Kata is an abstraction layer over hypervisor
isolation, it could potentially evolve to use other forms of isolation
in the future.

Allison



More information about the Kata-hypervisor mailing list