IBM Pledges To Make Xen More Secure

An anonymous reader writes "In the latest posting on the Xen developer list, IBM pledges to make Xen more secure by porting its secure hypervisor (sHype) architecture to it. In their posting, IBM discusses an SELinux like access control frame work, resource control and monitoring and trusted computing support for Xen. It appears that a lot is happening on the Xen front (for example, the announcement of XenSource Inc. and Intel's code drop in the xeno-unstable.bk tree for their super secret VT CPU)."

Comments

Did anyone else...

[Lostie]

... think of Half-Life when reading the headline?

I'm lazy, refuse to RTFA

[LowneWulf]

.... seriously people, when describing some new feature of some obscure software package, can you PLEASE tell us WHAT IS IS!?!??!one!!?

"And now, Fronzo v2.1.e, now 21% more secure!"

Re:I'm lazy, refuse to RTFA

[inox]

xen is certainly not an obscure software package.
read more at http://www.cl.cam.ac.uk/Research/SRG/netos/xen/

its a virtual machine monitor that allows you to run concurrently multiple OS on the same machine, achieving the same kind of functionnality than vmware, although the approaches are different

What this all means

[Anthony Liguori]

Xen is an open source hypervisor for intel hardware. A hypervisor allows multiple operating systems to run side-by-side simultanously. Don't think VMware, think partitioning on a mainframe.

Intel's VT technology is hardware support for partitioning. Google it.

sHype is a research hypervisor at IBM that implements advanced security mechanisms much in the same way that SELinux does.

So, think mainframe style partitioning with the security of SELinux.

Re:Doesn't run Windows

[keebler]

It's because Xen requires modifications to the OS in order to function. An earlier version supported XP (sorta), but it hasn't been maintained.

VMWare doesn't require OS modifications because it virtualizes the entire machine (slow). Xen does, because it only fully virtualizes some resources, and forces the OS to go through the hypervisor (not as slow).

Re:Questions

[Transdimentia]

The first thing that pops into my mind would be for partitioning your machine into slices for hosting/dedicated customers while preventing them from walking on each other or even knowing they are there?

Re:Questions

[Chirs]

It's roughly 10 times faster than UML.

Re:Questions

[Paul Crowley]

I'd assumed you were greatly exaggerating for dramatic effect, but benchmarks show a range from almost no improvement to a factor of 5.

Re:Doesn't run Windows

[Eric Smith]

There are instructions on the Intel that are not easily virtualized (read this as expensive to run). That is what you get with VMWare/Bochs over Xen.

Both Intel and AMD have stated that they plan to add virtualization support to forthcoming CPUs, which will have at least two useful benefits:

1. VMware will run with much lower overhead, because it will no longer have to prescreen instruction sequences for those that have to be simulated (or binary translation, or whatever it s they're currently doing)
2. Xen will be able to support unmodified guest operating systems

I assume that the latter is what the mentioned Intel code drop is all about.

Intel has mentioned two (different?) virtualization features, code named "Vanderpool" and "Silvervale". AMD calls theirs "Pacifica", and it is apparently not a clone of the Intel schemes, though it is expected to provide the same benefits.