Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Virtual Machine as a core Android Primitive

android-developers.googleblog.com

Post reply on HN
Print view View original

61–70 of 177 posts

Re: Virtual Machine as a core Android Primitive

#61

Post by jmprspret »

ForkMeOnTinder wrote: post #12

So on desktop, if I spin up a VM with networking disabled I feel pretty confident I can run anything safely, even malware is not going to escape. What's the current state of the art for Android virtualization? Let's assume we're talking about the newest Pixel and newest Android version. Is there any way to safely run malware or the Facebook app in some sort of air-gapped container and throw it away when you're done?

> Is there any way to safely run malware or the Facebook app in some sort of air-gapped container and throw it away when you're done?

User profiles can be used in this exact way. Guest user if you intend to install+wipe it right away (though this will prove cumbersome eventually due to having to reinstall the app every time, etc). There is a significant isolation benefit to them, though not currently virtualized. With the isolation can come usability issues. Like transferring files from one profile to another.

They can very slow however (slow to load+setup, and switch between, I mean. when you're inside its effectively a separate, fresh, OS install).

Re: Virtual Machine as a core Android Primitive

#62

Post by jbott »

Shoop wrote: post #52

How does two way isolation work? How do you prevent the host kernel (which presumably has full control of the hardware?) from inspecting the guest VM?

It looks like the host kernel is not in full control – there is a EL2-level hypervisor, pKVM [1] that is actually the highest-privilege domain. This is pretty similar to the Xen architecture [1] where the dom0 linux os in charge of managing the machine is running as a guest of the hypervisor.

1. https://source.android.com/docs/core/virtualization/architec... 2. https://wiki.xenproject.org/wiki/Xen_Project_Software_Overvi...

Re: Virtual Machine as a core Android Primitive

#63

Post by transpute »

Shoop wrote: post #52

How does two way isolation work? How do you prevent the host kernel (which presumably has full control of the hardware?) from inspecting the guest VM?

The architecture pattern is similar to Bromium/HP AX + Type 2 μXen on x86, https://www.youtube.com/watch?v=bNVe2y34dnM (2018), which ships on HP business PCs.

Bare metal runs a tiny L0 hypervisor making use of hardware support for nested virtualization. In turn, the L0 can run an L1 hypervisor, e.g. KVM or "host" OS, or minimal L1 VMs that are peers to the L1 "host"-guest of L0.

Google pKVM-for-Arm tech talk (2022), hopefully x86 will follow, https://www.youtube.com/watch?v=9npebeVFbFw

Re: Virtual Machine as a core Android Primitive

#65

Post by transpute »

kmeisthax wrote: post #64

The use of the word "privileged" seems to imply that only system apps will be able to use this - i.e. no installing virtual machines off Google Play anytime soon. Bleh.

Hopefully standard tooling will appear in time. Patreon PoC of unprivileged VMs, https://www.xda-developers.com/nestbox-hands-on/

> On the Pixel 7, the most configuration you'll need to do is similar to Shizuku. You connect to your own phone over wireless adb, configure the maximum container size, and then choose your Linux distribution. It'll download, configure, and then execute the virtual machine.

Re: Virtual Machine as a core Android Primitive

#66

Post by anonuser123456 »

Shoop wrote: post #52

How does two way isolation work? How do you prevent the host kernel (which presumably has full control of the hardware?) from inspecting the guest VM?

You make the various hardware modules security context aware. You then give the host a separate security context from guests. You need a trusted hypervisor to bootstrap it.

Re: Virtual Machine as a core Android Primitive

#67

Post by transpute »

ReactiveJelly wrote: post #56
Shoop wrote: post #52

How does two way isolation work? How do you prevent the host kernel (which presumably has full control of the hardware?) from inspecting the guest VM?

It must be relying on a TPM somehow, right? That isn't possible with any normal software VM

This eschews hardware-based TEE (like TrustZone or TPM) in favor of hardware support for nested virtualization, plus open-source L0 hypervisor code.

In the best case future, this will offer security properties based on a small OSS attack surface, rather than black box TEE firmware.

Re: Virtual Machine as a core Android Primitive

#70

Post by pjmlp »

jbott wrote: post #62
Shoop wrote: post #52

How does two way isolation work? How do you prevent the host kernel (which presumably has full control of the hardware?) from inspecting the guest VM?

It looks like the host kernel is not in full control – there is a EL2-level hypervisor, pKVM [1] that is actually the highest-privilege domain. This is pretty similar to the Xen architecture [1] where the dom0 linux os in charge of managing the machine is running as a guest of the hypervisor. 1. https://source.android.com/docs/core/virtualization/architec... 2. https://wiki.xenproject.org/wiki/Xen_Project_Software_Ov…

Commonly known as type 1 hypervisor architecture, by opposition to type 2 hypervisor, which run as OS services.

Ironically the revenge of microkernels, as most cloud workloads run on type 1 hypervisors.

Post reply on HN