Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Unikernels are secure

unikernel.org

Post reply on HN
Print view View original

21–30 of 142 posts

Re: Unikernels are secure

#21

Post by PeterisP »

Cieplak wrote: post #5

Hypothetically, if there were a buffer overflow in a unikernel process, wouldn't it potentially give the exploit full-system access, whereas a normal operating system would detect the out-of-bounds memory access and kill the process? I'm sorry if this is an ignorant question.

First, standard page fault mechanisms would still be in place, that's a processor/architecture feature, so out of bounds memory access would be detected just as in a normal operating system. Of course, a normal operating system does not detect many/most buffer overflows.

In general, you could have a unikernel where it's impossible to get executable buffer overflow because there are no memory pages that are both writable and executable - as the article describes, that'd need some help from the hypervisor for the initialization.

Return oriented programming exploits could work anyway, though.

Re: Unikernels are secure

#22

Post by Spivak »

elygre wrote: post #15
rwmj wrote: post #4

It's secure if and only if there's a formal proof.

That's like saying that the world was flat before they could prove that it is round.

No, that's like saying that we don't know what shape the world is before we could prove that it is round.

Re: Unikernels are secure

#23

Post by agumonkey »

meson2k wrote: post #12

> Good luck guessing that address. Our own unikernel, IncludeOS, randomizes addresses at each build, so even with access to source code you still don’t know the memory layout. "There is one mortal sin in computer security (or by the way, in any kind of security) that is feeling safe. It’s just a variation of pride to be true, but it’s very deadly. Blindly trusting a protection technology is an extreme error." Read up…

is linux randomizing is per exec ?

ps: BSD have started to randomize at boot time, fun times

Re: Unikernels are secure

#24

Post by PeterisP »

nkozyra wrote: post #7
Cieplak wrote: post #5

Hypothetically, if there were a buffer overflow in a unikernel process, wouldn't it potentially give the exploit full-system access, whereas a normal operating system would detect the out-of-bounds memory access and kill the process? I'm sorry if this is an ignorant question.

I'm not super familiar with this, but it seems like the question is what is "full-system" in this case if each application is sandboxed with its own embedded kernel? I mean there's no shell, ostensibly all other applications and system functions are bundled similarly, right?

It'd make exploits more difficult, but you'd still be able to upload your own code to do whatever you want.

The trouble is that instead of uploading "/bin/sh" you'd have to upload the whole shell which you'd want to run; instead of making a syscall for something that a normal kernel would do but this one doesn't, you'd have to compile and upload appropriate code (including device drivers) to get that done.

It'd be a "bring your own machine code" party.

Re: Unikernels are secure

#25

Post by geofft »

agumonkey wrote: post #23
meson2k wrote: post #12

> Good luck guessing that address. Our own unikernel, IncludeOS, randomizes addresses at each build, so even with access to source code you still don’t know the memory layout. "There is one mortal sin in computer security (or by the way, in any kind of security) that is feeling safe. It’s just a variation of pride to be true, but it’s very deadly. Blindly trusting a protection technology is an extreme error." Read up…

is linux randomizing is per exec ? ps: BSD have started to randomize at boot time, fun times

> is linux randomizing is per exec ?

Not entirely sure what you're meaning to ask, but yes, Linux does KASLR and tries very hard not to leak pointer addresses from the running kernel to unprivileged userspace:

https://lwn.net/Articles/569635/

It's been enabled by default since the upstream 4.12 kernel, and usually well before that in distros.

Re: Unikernels are secure

#26

Post by rf15 »

Spivak wrote: post #22
elygre wrote: post #15

Earlier quoted context omitted.

That's like saying that the world was flat before they could prove that it is round.

No, that's like saying that we don't know what shape the world is before we could prove that it is round.

No, it's like saying it is round "if and only if" we can prove that it is round.

Re: Unikernels are secure

#27

Post by geofft »

> Unikernels have no shells. Most attacks I’ve seen invoke /bin/sh to modify the system they are attacking. Without a shell the attacker doesn’t have this opportunity. This forces the attacker to use machine code to subvert the system, decreasing the likelihood of succeeding with the attack.

This argument is completely incoherent.

Re: Unikernels are secure

#28

Post by mtgx »

> IncludeOS is a clean-slate unikernel written in C++ with performance and security in mind.

One of those things doesn't belong there. Guess which?

Re: Unikernels are secure

#30

Post by benchaney »

Cieplak wrote: post #5

Hypothetically, if there were a buffer overflow in a unikernel process, wouldn't it potentially give the exploit full-system access, whereas a normal operating system would detect the out-of-bounds memory access and kill the process? I'm sorry if this is an ignorant question.

> if there were a buffer overflow in a unikernel process, wouldn't it potentially give the exploit full-system access

Yes

> whereas a normal operating system would detect the out-of-bounds memory access and kill the process?

No. A buffer overflow in a normal operating system usually results in the the attacker gaining control over the process that the buffer overflow occurred in. This is not as bad as an attacker gaining full system access, but is generally plenty for an attacker to accomplish their goals.

Post reply on HN