Re: [Xen-users] Using Xen as a jail for malicious code

[Mark Williamson <mark.williamson@xxxxxxxxxxxx>]

> > That's what it was originally created for: containment of arbitrary
> > untrusted code submitted to a Xenoserver (Xenoservers project described:
> > http://www.cl.cam.ac.uk/Research/SRG/netos/xeno/).
>
> What about the rogue DMA problem mentioned in some of the papers?
> Has this been addressed?

Rogue DMAs was only a problem if domains have access to real devices - for 
unprivileged domains (the norm) which just have virtual devices it's never 
been an issue.

Conversely, domains which do have real device access must always be considered 
privileged, due to limitations of current hardware.  Usually that's just 
dom0, though, unless you've got a really advanced setup.

Cheers,
Mark

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users