On 08/06/2018 05:53 PM, Paolo Bonzini wrote:
Nice. This is a bit more tricky to assess; it's an (important) QoI issue but it's not a fundamental problem with virtual machines in general or KVM in particular. In a perfect world, the device emulator would be confined using OS-level security features such as cgroups, capabilities, seccomp, etc. However, this is not always the case and in particular it's not for Kata containers (though its predecessor Clear Containers did some OS-level isolation of the device emulator).
Nod, I'm not convinced that either virtual machines or containers are fundamentally and universally a more secure approach. So much depends on implementation, and if you get really, really fundamental both are just a way of running an OS image as an isolated process on a kernel, so a case could be made that the differences between the two are relatively superficial. Some of the interesting future directions are hybrid approaches that look at secure isolation features and how to combine them, without getting too caught up in whether those features are commonly associated with virtual machines or containers.
Note that these same modular features can be applied to virtual machines simply by running the device emulation in a container. This provides isolation for the parts that are most complex and deal the most with untrusted data from the guest.
Nod, more hybrid approaches.
I think it would be disingenuous, and it somewhat reminds me to Theo de Raadt's famous virtualization quote[1], to say that OS-level containers can be more secure than virtual machines.
I started with the preconception that virtual machines were more secure, and didn't give it up lightly. Which doesn't mean that all arguments in favor of container security are compelling. :) But, some are.
Capabilities and the like are nice, but software has bugs and that's why you defend in depth. Virtual machines are just an additional layer in the defend-in-depth onion.
That would be more compelling if the additional layer was substantially more secure. Two weak layers of security is better than one weak layer of security, but a single layer that combined the security features of those two layers would be equivalent to them (and likely perform better). No hacker ever has broken one weak layer of security and decided not to go any farther because it wasn't worth the bother of breaking a second weak layer of security. Allison