Thankfully, better designs such as seL4's VMM do exist, although it might need a little more work [1] until usable for the purpose.
Sorry for not googling before asking...
KVM is, like VMware, a Type 2 hypervisor. [1]
Xen is a proper Type 1 hypervisor.
[1] https://microkerneldude.wordpress.com/2010/10/14/much-ado-ab...
I mean, the US government no doubt had influence on the Trusted Computing Group (too bad the EFF totally shunned it), and through the magic of product binning and chip fab costs, we all have trusted platform modules.
ASLR currently seems wimpy.
I'm certain you are in a position to accomplish a great deal, no matter where you are in the hierarchy. Maybe the future is x86 hardware emulation for user mode processes.
https://secure-os.org/pipermail/desktops/2015-November/00000...
Unlike the nitty gritty of how the sandbox works, the IPC changes often with new releases. And quite frankly it isn't as fun, cool, or interesting as VMMs or other sandboxing techniques, so a lot of the time it isn't given the close eye that it should.
Intel should be considered to be totally unreliable and incompetent.
I mean, no one buys office store safes and expects their things to be secure in them. But a processor is a little more expensive than a cheap safe and holds more valuable things.
Edit: and besides, Fortezza is an SSL protocol option.
https://groups.google.com/forum/m/#!topic/qubes-devel/jEe4pQ...
> It seems one major residing problem with KVM is the Linux kernel (which is large and vulnerable). A port of KVM to a thinner base layer would obviate those issues.
It's a pretty deep rabbit hole if you really want to go down it. You can make a case for not trusting any CPU that you didn't design and fab yourself, and even then you have to watch out for your own mistakes and bugs that can be used against you.
Tiny hypervisors like NOVA http://hypervisor.org, seL4-based are the ideal solution, but sadly no one seems to be pushing to make them usable and production-ready :(
SGX is at least a middle ground - it integrates the memory access checks very deep into the memory access circuitry, sufficiently deep to block all other privilege levels on the CPU. Whilst there may well be implementation flaws in SGX itself so far most attacks have been mounted via side channels, not directly exploiting CPU bugs.
In this sense my original statement was correct. Intel is pushing secure CPUs forward more than any other vendor.
I guess it's your use of 'proper' that bugged me.
http://os.inf.tu-dresden.de/papers_ps/liebergeld-diplom.pdf
Complexity was still yoo high. Most in high-assurance security were trying stuff like Nova microhypervisor as a result. KVM on separation kernels might be worth further investigation for these platforms that will stay on KVM regardless.
It is the wrong sense. Intel is playing catchup more than any other vendor and are selling a product that is nothing more than a bunch of cobbled together features, my opinion in the view of the statement that AMD is glued together.
I haven't used Xen for a while, but seemed to recall that Amazon forked it way back in the 3.x days and had been doing their own incompatible thing with it since then.
Corrections welcome of course :)
The project would cost money that Google has. There's not much new to invent, though. They just have to apply what's there. The performance penalties and ASIC costs are even much lower than they were in the past. Google refuses to do these things because either (a) they don't know about them or (b) more likely their management doesn't want to commit that much money to secure hardware. Typical of the big companies with the smartcard market the only exception far as stuff non-enterprises could afford.
For a quick example, they did retool software to support OpenPOWER architecture but could've also funded Raptor Workstation in a desktop or esp server form themselves. It would've been to their budget like pennies are to ours. Not even that. At least they did the Chromebooks, though, which are good for a lot of non-technical folks.
http://www.smecc.org/The%20Architecture%20%20of%20the%20Burr...
http://www.crash-safe.org/papers.html
A more complex one is below that was also designed by one person for his dissertation. Knocks out all kinds of issues without modifying the processor. It has stuff to improve for sure but it think it proves the point pretty well. The stuff corporate teams were designing comes nowhere near this because they don't know much about high-security design. A critical part of that isn't features so much as a balancing act between what protection mechanisms do and don't that tries to minimize complexity to low as is possible.
https://theses.lib.vt.edu/theses/available/etd-10112006-2048...
And one open-source one on MIPS for capability-based security that runs FreeBSD:
https://www.cl.cam.ac.uk/research/security/ctsrd/cheri/
A company or group of hardware volunteers could develop this into something at least as usable as a multi-core ARM CPU on RISC-V or OpenSPARC. It wouldn't take tons of money esp if they worked their way up in complexity. The hard stuff is already done. People just need to apply it. They could even pay these academics to do it for them with open-sourced results. They even get a huge discount on the EDA tools that can be six digits a seat.
You're right that Intel is screwing up and playing catchup cobbling together features. There was stuff in the available literature better than most of what they're doing. They even have a separation kernel from Wind River they're not employing. Managers without security expertise must be pushing a lot of this stuff.
It is easy to make a secure coprocessor, since the formal logic proofs aren't for such a long set of code.
The fact that rootkits are even possible, that without malware that doesn't involve an elaborate rewrite of the kernel, shows how terrible everything is.
If I didn't know any better, I'd say that Intel is hiring the designers who thought Internet Explorer should be in the kernel.