Please create an account to participate in the Slashdot moderation system

 


Forgot your password?
Close
typodupeerror
×
IBM Software Programming Security Linux IT Technology

IBM Pledges To Make Xen More Secure 134

Posted by Hemos from the getting-news-for-development dept.
An anonymous reader writes "In the latest posting on the Xen developer list, IBM pledges to make Xen more secure by porting its secure hypervisor (sHype) architecture to it. In their posting, IBM discusses an SELinux like access control frame work, resource control and monitoring and trusted computing support for Xen. It appears that a lot is happening on the Xen front (for example, the announcement of XenSource Inc. and Intel's code drop in the xeno-unstable.bk tree for their super secret VT CPU)."
This discussion has been archived. No new comments can be posted.

IBM Pledges To Make Xen More Secure More

IBM Pledges To Make Xen More Secure

Comments Filter:

  • Did anyone else... (Score:4, Funny)

    by Lostie ( 772712 ) on Monday January 17, 2005 @10:31AM (#11385441)
    ... think of Half-Life when reading the headline?
  • I could only hope that will be the next posted story.

  • I'm lazy, refuse to RTFA (Score:5, Insightful)

    by LowneWulf ( 210110 ) on Monday January 17, 2005 @10:35AM (#11385481)
    .... seriously people, when describing some new feature of some obscure software package, can you PLEASE tell us WHAT IS IS!?!??!one!!?

    "And now, Fronzo v2.1.e, now 21% more secure!"

    • Re:I'm lazy, refuse to RTFA (Score:5, Informative)

      by inox ( 75648 ) on Monday January 17, 2005 @10:37AM (#11385505) Homepage
      xen is certainly not an obscure software package.
      read more at http://www.cl.cam.ac.uk/Research/SRG/netos/xen/

      its a virtual machine monitor that allows you to run concurrently multiple OS on the same machine, achieving the same kind of functionnality than vmware, although the approaches are different
      • its a virtual machine monitor that allows you to run concurrently multiple OS on the same machine, achieving the same kind of functionnality than vmware, although the approaches are different
        And that's not obscure?
        • And that's not obscure?

          No. Not even close. Having running few different virtual systems can make your system much more secure. The only problem was that running virtual servers was real CPU hog. That's why Xen uses paravirtual approach. Difference between virtual and paravirtual is that virtual is translating operations, while paravirtual enables direct access. One problem in paravirtual access is that OS running in it must be modified (so,... no Windows and no OSX here)

          You can solve all problems which w
          • I repeat: "And that's not obscure?"

            useful != not obscure

            Please consult the definition of obscure [m-w.com] to understand my intent. #3 is the best fit for what i'm trying to convey, "relatively unknown" versus "useless" or anything similar.

            I have no doubt that it's useful to somebody (otherwise IBM et al would have no interest in it), but that doesn't make it any less obscure. Most organizations will throw another box on the line instead of parallelizing / virtualizing the OS, it's just Easier(TM). It might b
      • Sounds pretty obscure to me. How many people (slashdot readers, at least) seriously have a need for this?
        • Slashdot users may not need this, but it is usefull for businesses of all sizes. That is why most corporations like IBM, HP, Intel and Novell are starting to have employees work on Xen.
          • I realize that many companies have a legitimate need for this. My point though was that LowneWulf was right to call this obscure. The target audience or this post is not businesses of all sizes, it's slashdot readers.

            I could see this being very useful at my company, and if we used it I'd be the one to implement it. Still, I hadn't heard of it either, and I've been looking. So even the people it's intended for haven't heard of it. I'd say that qualifies it as obscure (although I'd like to see that change.)

        • Re:I'm lazy, refuse to RTFA (Score:1, Interesting)

          by Anonymous Coward
          I'm team lead for Unix/Linux for a division of a Fortune 300 and we're deploying Xen all over the place. I'd say it's not obscure at all. My objective is to collapse a couple hundres RH installations onto a handfull of boxes. We don't need a z800 but we also don't need 100+'s of discrete hardware systems either.

          With IBM, Novell, etc. getting on board, and with containers in Solaris 10 being deployed more, the VM architecture is going to be huge very soon - no matter who's implmentation.

        • Sounds pretty obscure to me. How many people (slashdot readers, at least) seriously have a need for this?

          Well if you run a server of any kind virtualization is useful to you. I run a server for some of my own stuff (email, web, etc). It is a UML virtual machine (same concept as this Xen stuff) and it is the only virtual machine running on that physical hardware.

          What's the point of running only one server in a VM?

          Well, I can get consistent image-level backups of the system without shutting the system d

      • Why do so many vendors go on about how they take security seriously and are striving to make their product more secure..?

        I for one hope and assume this of ALL vendors.. so why tell me that? go out and make it secure, this should be a standard practice and not a feature. "NEW AND IMPROVED! OUR SYSTEM DOESN'T CRASH AND HACKERS CAN'T GET IN AS EASILY!! BUY NOW!"..
        • I can't think of anything more foolish if you are an IT professional than to "assume" products are secure.
        • Reminds me of washing powder adverts; "New improved Ariel gets clothes even whiter!". We got this for about 10 years and you're wondering about the old Ariel from 10 years ago. What was it, "get some stains out, some of the time"?

          Extend that to Windows which has become "faster and more secure" with each iteration; by inference, Windows NT 3.x was klunky, slow and a collander of security holes. Admittedly, that's not far from the truth, but I doubt it was ever advertised that way.

      • Xen is exceptionally obscure. Sorry to burst your bubble.

        I also don't understand why people continue to compair Zen to VMWare. Not only are the approaches different, so is the functionality. I guess the fact that both products use the term 'virtual' confuses people.

      • its a virtual machine monitor that allows you to run concurrently multiple OS on the same machine, achieving the same kind of functionnality than vmware, although the approaches are different

        XEN, while unlike the VMware Workstation and GSX Server versions, works pretty similar to VMware ESX Server. It is kind of like a micro kernel providing a hardware abstraction layer and scheduling mechanism. The first guest image booted controls the abstraction layer, pretty much like XEN.

        Well, the pricing approac
    • today's fortune just about gets it: ... Logically incoherent, semantically incomprehensible, and legally ... impeccable!

      2 out of 3 ain't bad.
    • Slashdot has mentioned Xen 3 times in as many months. Magazines about Linux have been publishing information about Xen since it is a major project stirring a lot of interest in a lot of people. It's not obscure because you haven't heard of it. That just means that it's not a userland tool.

  • Less jumping puzzles please! (Score:1, Funny)

    by Anonymous Coward
    And also close up those portals, we don't want any alien invasions.

  • Question (Score:2, Insightful)

    by af_robot ( 553885 )
    What is XEN?!

  • What this all means (Score:5, Informative)

    by Anthony Liguori ( 820979 ) on Monday January 17, 2005 @10:42AM (#11385546) Homepage
    Xen is an open source hypervisor for intel hardware. A hypervisor allows multiple operating systems to run side-by-side simultanously. Don't think VMware, think partitioning on a mainframe.

    Intel's VT technology is hardware support for partitioning. Google it.

    sHype is a research hypervisor at IBM that implements advanced security mechanisms much in the same way that SELinux does.

    So, think mainframe style partitioning with the security of SELinux.

    • Re:What this all means (Score:1, Informative)

      by Anonymous Coward
      Or if you are going to think VMWare, think VMWare ESX server edition...

      Xen can do CPU bounding on its guest OSes making sure they only use a fixed amount of CPU cycles. This ability differentates it from User-Mode-Linux and other kernel-as-process type virtualizations.
    • think partitioning on a mainframe.

      Now thousands of Linux geeks will install this on their $299 PC and think "Holy shit, I have a mainframe in my house! I need to put this on my resume!"
      • Why not use http://www.conmicro.cx/hercules/ to get a real 370/s390/z type box on your Linux machine? From mainframe like to mainframe.

        And then there is FLEX-ES if you want support, and that can even use pci-to-channel cards to support real mainframe devices.
    • So XENbios wouldn't be out of the question? :-)

  • Doesn't run Windows (Score:3, Interesting)

    by cerberusss ( 660701 ) on Monday January 17, 2005 @10:49AM (#11385599) Journal
    I wish it would run Windows, but it doesn't [cam.ac.uk]. That would mean a cheap alternative to VMWare [vmware.com] and would also mean a much higher usage (and thus testing).

    They give a reason:

    Longer term, virtualisation features in next-generation CPUs should make it much easier to support unmodified OSes: at that time we will reconsider Windows support.
    Although I understand, I'm unsure why VMWare and Bochs [sourceforge.net] can run Windows and Xen can't...

    • Re:Doesn't run Windows (Score:5, Informative)

      by keebler ( 182372 ) on Monday January 17, 2005 @10:55AM (#11385641) Homepage
      It's because Xen requires modifications to the OS in order to function. An earlier version supported XP (sorta), but it hasn't been maintained.

      VMWare doesn't require OS modifications because it virtualizes the entire machine (slow). Xen does, because it only fully virtualizes some resources, and forces the OS to go through the hypervisor (not as slow).

      • An idea (Score:3, Interesting)

        by Mitchell Mebane ( 594797 )
        I wonder if ReactOS has any plans for supporting Xen in the future? They're not at a "Windows replacement" stage yet, but the project seems to be moving pretty fast.
    • There are instructions on the Intel that are not easily virtualized (read this as expensive to run). That is what you get with VMWare/Bochs over Xen.

      If you need to run Windows, than you can afford to do VMWare. I paid 200 for it so that I could run several linux instances (modeling network equipment).
      • If you need to run Windows, than you can afford to do VMWare. I paid 200 for it so that I could run several linux instances (modeling network equipment).

        Obviously you are referring to VMware Workstation. There is also VMware GSX (for workgroup level server virtualization) and VMware ESX (for more enterprise level functionality like management and moving live virtual servers to other physical servers).

        VMware is not just targeted at development environments. It is a robust and capable virtualization pla

        • No doubt that Xen will perform better for any OS that supports it and it will be a great next generation virtualization platform.
          <sarcasm>
          I can just see Microsoft jumping though hoops in order to get XP (or LongHorn) to work with this.
          </sarcasm>
          • Microsoft could utilize Xen too.. people could run multiple instances of Windows on a single server. With Windows, that would mean more licenses sold.

            The interesting thing about this is how it could eventually eliminate the need for dual-booting for users transitioning to Linux while allowing accelerated 3d to both systems. (meaning, you can game from both OS without rebooting).

            This is, of course, dependent on Microsoft supporting Xen. They are much more likely, however, to build a proprietary system o
        • VMware already supports any mainstream x86-based OS

          I notice that doesn't include SCO [vmware.com]:

          The following guest operating systems may not work with VMware Workstation. There are currently no plans to support these guests:
          • BeOS
          • IBM OS/2 and OS/2 Warp
          • Minix
          • QNX
          • SCO Unix
          • UnixWare

          Oh right, you said mainstream. Nobody actually uses SCO products anymore do they?

      • If you need to run Windows, than you can afford to do VMWare

        It's an excellent product and my company paid for it. However, I don't find the pricing friendly for the Linux hobbyist who runs Linux fulltime but wants an occasional trip to Windows.

      • Re:Doesn't run Windows (Score:5, Informative)

        by Eric Smith ( 4379 ) * on Monday January 17, 2005 @02:42PM (#11388058) Homepage Journal
        There are instructions on the Intel that are not easily virtualized (read this as expensive to run). That is what you get with VMWare/Bochs over Xen.
        Both Intel and AMD have stated that they plan to add virtualization support to forthcoming CPUs, which will have at least two useful benefits:
        1. VMware will run with much lower overhead, because it will no longer have to prescreen instruction sequences for those that have to be simulated (or binary translation, or whatever it s they're currently doing)
        2. Xen will be able to support unmodified guest operating systems
        I assume that the latter is what the mentioned Intel code drop is all about.

        Intel has mentioned two (different?) virtualization features, code named "Vanderpool" and "Silvervale". AMD calls theirs "Pacifica", and it is apparently not a clone of the Intel schemes, though it is expected to provide the same benefits.

        • Both Intel and AMD have stated that they plan to add virtualization support to forthcoming CPUs... Xen will be able to support unmodified guest operating systems

          I have read about those plans. Still I wonder how well the virtualization will work. So maybe they will be able to virtualize a CPU we know today, but will they also be able to virtualize themselves? If the new CPU cannot virtualize itself it won't be long before we see a new Windows version requiring the virtualization features, such that this n
          • Well the interesting thing that IBM has added to the Power line is the ability to MICROpartition the LPARs. Think about being able to carve out portions of a CPU instead of having to waste a full CPU on the LPAR.

            When you really think about "On Demand" in relation to technologies like paritioning and virtualization, it really sinks in what they mean. Why waste a full system set of resources allocated to a database server just for backup capability. Why not partition a micropartition of resources such has 1
        • No, Please no. Not a rehash of 3dNow! / MMX again, PLEASE!?!?
    • It's a difference between Free Software, and an encumbered bit of software because they'd have to purchase an MS Source License to build their own compatible HAL.
      • That might be true, but there must be technical ways around this. I still find it a damn shame that with all this knowledge in the open source community, there's still no piece of software that matches VMWare's featureset.
        • I'm sure there is. Take a collection, gather $20,000-$50,000 USD, and buy a commercial source license to redistribute the HAL, vs. what was surely an educational source license that the Xen developers used.

          Then you can Open Source all of Xen, except the Windows HAL, which they can charge a nominal fee for, and continue development.

          It's a cost vs. effort tradeoff. XEN is a first step, code morphing on the fly is next. It will take time, but eventually it will arrive.

  • 1.3 Which OSes run on Xen?

    To achieve such high performance, Xen requires that OSes are ported to run on it. So far we have stable ports of Linux 2.4, Linux 2.6, and NetBSD. Ports of FreeBSD and Plan 9 are nearing completion.

    1.4 Does Xen support Microsoft Windows?

    Unfortunately there are no plans to support any versions of Windows in the near future. Furthermore, a port of Windows would be encumbered by licensing issues. Longer term, virtualisation features in next-generation CPUs should make it much easi

    • Re:Questions (Score:3, Insightful)

      by Transdimentia ( 840912 )
      The first thing that pops into my mind would be for partitioning your machine into slices for hosting/dedicated customers while preventing them from walking on each other or even knowing they are there?

    • Re:Questions (Score:4, Informative)

      by Chirs ( 87576 ) on Monday January 17, 2005 @11:01AM (#11385691)
      It's roughly 10 times faster than UML.

    • I could see concurrently running Windows and linux as a useful thing in business, since sometimes you just can't get away from Windows.

      [Warning : Flamebait ahead]
      Excuse-me.
      You don't think running Windows on a MainFrame, don't you ?
      You know these big super computer that are supposed to crash only once per century ?
      [/Warning : Off]

      More seriously : Xen is intended for machines that are only used to run different flavors of unix any way. I could eventually complain about it's lack of support for Solaris. But

      • Thank you. I asked for technical answers, not "We ahte MSFT ahhahaha j00 suck" zealot bullshit.

        There's a huge need for Windows. Hell, The AS400 runs Windows. There are apps, services, interfaces, etc, that only run on Windows, whether you like it or not. This is why vmware exists, and actually makes money.
        • This is why vmware exists, and actually makes money

          So use it. Go ahead and try to convince Microsoft to support Xen. Please let us know how that goes.

    • Re:Questions (Score:1, Informative)

      by Anonymous Coward
      What is Xen good for, exactly? I mean I can run NetBSD, linux, linux and linux on the same machine?

      Xen can run it almost at its native speed, unlike other virtualization technologies.
    • For an example, think virtual webhosting. Most hosting companies will sell you either a colocated box where you get root, or a shared hosting account where you don't. Some of them will offer UML or vservers alternatives where you get root on a virtual box. Xen allows the same thing, but faster than UML or VMWare, and with more total separation than vservers.

    • Re:Questions (Score:2, Informative)

      by Lemming Mark ( 849014 )
      In addition to other posted comments, Xen can also perform live migration (move running virtual machines to another host without stopping them) and can run Linux device drivers in sandboxed, restartable domains.
    • What is Xen good for, exactly? I mean I can run NetBSD, linux, linux and linux on the same machine?

      Imagine a different kind of chrooted enviroment. Or imagine each user being able to have full access to a linux distro on a single machine.

    • One of the biggest potential features (and people seem to have missed that) is how failovers could get to work. So let's you have multiple Xen hosts, running multiple OS's on them. Should a Xen host fail then the OS's and applications running on it migrate to another Xen host dynamically without any noticable slowdown. Similarly think UML, but fast enough to actually replace ALL servers. Not just development boxes that you didn't want to purchase hardware for, but all servers in an enterprise could resi

    • In what sort of situation would I want more virtual linux machines, where UML wouldn't suffice? When would I need to run NetBSD and linux together, when everything that runs on one can be recompiled easily for the other?

      Our company uses Xen in order to provide our customers with their own virtual server for services that we provide. We used UML at first, but found the performance very poor. While researching Xen, we got response times 2 to 10 times faster than the same site on UML. And UML had a nasty ha

  • Trust Blues (Score:1, Troll)

    by Doc Ruby ( 173196 )
    If IBM makes an open-source Trusted Computing component that is indistinguishable to Windows components authenticating it across the Net, IBM will have made up for a multitude of sins. Between IBM and Novell, Linux might just keep us out of the clutches of the Windows hegemony for another decade.
    • I hate to see Solaris/Sun go down
      I hate to see Solaris/Sun go down
      'Cause, my server, it's got no workaroun'

      Upgrade tomorrow, like I upgraded today
      If I upgrade tomorrow, like I upgraded today
      I'll install XP and get some bills to pay

      Redmond software, with its web of trust
      Pulls the users around by their technolust
      With crappy software that should be left to rust

      Give me the Trusted Computing blues
      Blues that I can't use
      Swap my Linux for Windows
      Lord, make me pay my dues

      I love IBM like a jailbird loves the key
      L
  • Finally a software product that describes its main characteristic after its name! Of course that was after the market-leader of such trend - "Loooong"horn.
    • Yup, this shit is beyond technobabble

      Original
      "Intel's code drop in the xeno-unstable.bk tree for their super secret VT CPU"

      Technobabble
      We have quasixenoinstabilities Doctor! Reverse the polarity of the neutron flow!

      Maybe I need to remodulate the harmonics in my English parser or something, but the technobabble makes more sense.

  • I know it takes some binary changes, but have any 'patches' been released yet to allow for windows ( xp/2000/2003 ) to run as a client yet?

    • You can't "patch" the binary OS; there are fundamental changes that have to be made about how page tables and certain supervisor-only operations are done. Microsoft Research UK actually ported the XP kernel to Xen 1.2, reportedly, but due to licensing restrictions, it won't be released publicly (and I suspect from higher-up pressure to make sure that their VirtualPC stuff is the preferred virtualization environment for use with Windows).
  • What with all those portals opening up...who knows what your going to get.

    What do I know...I'm from City 17, not Black Mesa.
  • On it's big machines (mainframes) you can run lots of virtual Linux machines under VM, by using Xen they will be able to have the same configuration from big zSeries (Mainframe) to iSeries (AS400) to small Intel serers and maybe even desktop.

    Presumably Xen isn't quite as secure as VM and this work will fix that.

    I wonder if they will then port OS/390 and OS/400 to run on top of Xen ?

    • Presumably Xen isn't quite as secure as VM and this work will fix that.
      It's not a case of security in the conventional sense (exploits, etc.). The enhancements are specifically to allow complex Mandatory Access Controls (SELinux style), which Xen itself doesn't currently support (although you can run SELinux in Xen VMs, there's nothing that works on a whole-machine level.
  • At first gland, I though the title was..

    IBM Pledges To Make XMen More Secure

  • XEN [cam.ac.uk] does for the Intel platform what OpenPower [ibm.com] does for the Power platform.
  • For some interesting information on Xen take a look at

    http://www.linux-mag.com/2004-10/xen_01.html/ [linux-mag.com]

    Oz

  • Now all we need is project plans to implement most of these into the Linux kernel.
    • Support for running on Xen 2.0 is likely to be integrated into the 2.6 kernel in the near future. Support for running 2.4 on Xen 2.0 will remain a separate patch.

      Xen support is planned to be checked into the mainline FreeBSD tree. Support for Xen 1.2 is already in the NetBSD mainline but for Xen 2.0, you need the patches that come with the Xen distribution.
  • Does anyone have a link or a torrent for the XenDemoCD referenced on their main page [cam.ac.uk]? It's not on their downloads page [cam.ac.uk] like the link implies.
    • Sorry for being a poon-tard, I found the good stuff here [cam.ac.uk].
      • I wouldn't bother with the 1.2 demo CD - 2.0 is a massive leap over 2.0. Unfortunately there's not an existing CD for 2.0 but it's quite simple to install on your hard drive.
    • There's not a demo CD for 2.0. It's simple to set up 2.0 on an existing Linux install and start testing virtual machines. There is a user developing a new, improved LiveCD, which may be distributed in future.

Slashdot Top Deals

"Being against torture ought to be sort of a multipartisan thing." -- Karl Lehenbauer, as amended by Jeff Daiell, a Libertarian

Close