Xen on x86 platforms offers two kinds of virtual machines: PV and HVM. PV is the oldest kind of guest, doesn't need any emulation, but requires extensive modifications to the guest operating system kernel. HVM is a newer kind of guest, which exploits hardware virtualization extensions, and offers an emulated PC-like environment. Linux typically runs on Xen as a PV guest but can also run as an HVM guest very efficiently. Windows runs as an HVM guest only.
QEMU is a critical component in Xen deployments because is in charge of emulating most devices for HVM guests, including IDE disks and PCI network cards. In fact in the Xen community QEMU is often called the "device model". QEMU's emulated interfaces are conveniently available for the guest to use. At the same time of course they are also exposed to malicious guests, which are inevitably going to try to find vulnerabilities in those interfaces, to take control over the system.
Therefore securing QEMU is critical. QEMU should be protected from guest attacks, not just in best case scenarios, where deployments use advanced and complex security hardening techniques, such as stubdoms or SELinux, but in all cases, for all users.
This presentation will show the defense in depth mechanisms which the Xen Project is putting in place to secure the execution of QEMU in Dom0 by default. The talk will explain the reasons behind the design choices and how they compare against other hypervisors and other deployment scenarios. Users will learn the trade-offs of the different solutions and will learn how to discern secure from insecure configurations.
Speakers: Stefano Stabellini Ian Jackson