1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
|
<?xml version='1.0' encoding='UTF-8'?>
<!DOCTYPE guide SYSTEM "/dtd/guide.dtd">
<!-- $Header$ -->
<guide disclaimer="draft" link="/proj/en/hardened/hardened-virtualization.xml"
lang="en">
<title>Gentoo Hardened Virtualization Guide</title>
<author title="Author">
<mail link="basile@opensource.dyc.edu">Anthony G. Basile</mail>
</author>
<abstract>
Virtualization is a key component in current IT infrastructure. Although
one can easily harden a virtualized operating system instance, you still
require hardening rules on the host level as well. This guide gives you
insight on how to harden the host using Gentoo Hardened.
</abstract>
<!-- The content of this document is licensed under the CC-BY-SA license -->
<!-- See http://creativecommons.org/licenses/by-sa/2.5 -->
<license/>
<version>1</version>
<date>2010-10-31</date>
<chapter>
<title>Hardening a Virtualization Environment</title>
<section>
<title>Virtualization and Hardening?</title>
<body>
<!-- TODO Add proper kernel configuration examples -->
<p>
The hardening of virtualized environments is growing in popularity.
Virtualization has the advantages of isolating services on various slim guests
running on a larger server, while hardening provides for enhanced security for
both the guests and host. In practice, however, getting the two to work
together is not always an easy task as the technologies employed by one often
interfer with the other. This is complicated by the fact that there many
implementations of virtualization and many degrees of hardening. This guide
aims to provide some clarity to the issues and outline some best practices.
</p>
</body>
</section>
<section>
<title>Types of virtualization and degrees of hardening</title>
<body>
<p>
This guide looks at virtualization using kvm, xen and vmware under hardening
by GRSEC/PaX. For each type of virtualization, we discuss what hardening
features work for the host and guests without either degrading performance
horribly or breaking completely. This is not a howto on setting up
virtualization since that is covered elsewhere; rather, we limit our
discussion to just what hardening features ought to be enabled or disable when
configuring the kernel of the host or guest operating systems.
</p>
</body>
</section>
<section>
<title>Hardening KVM</title>
<body>
<p>
KVM (Kernel-base Virtual Machine) provides virtualization on x86 and x86_64
hosts that have the required hardware support (Intel-VT or AMD-V). The host
uses a general kernel module (kvm.ko), a processor specific module
(kvm-intel.ko or kvm-amd.ko), and a userland utility (qemu-kvm), to run the
guests. The guests can be configured to use emulated hardware (full
virtualization) or virtio (para virtualization). Paravirt has the advantage
of increasing performance and providing a common I/O interface between host
and guest. Resources for setting up kvm on gentoo can be found at the end
of this guide.
</p>
<p>
As of this writing, there are no known restrictions on hardening for the
guest. Test of both x86 and x86_64 guests using either emulated hardware or
virtio, with all hardening features, including CONFIG_PAX_KERNEXEC and
CONFIG_PAX_MEMORY_UDEREF, have been successfull.
</p>
<table>
<tr>
<th>guest kerel config breakout</th>
</tr>
<tr>
<th rowspan=2></th>
<th colspan=2>CPU</th>
<th>AMD</th>
<th>INTEL</th>
</tr>
<tr>
<th>CONFIG_PAX_KERNEXEC</th>
<ti>Y</ti>
<ti>Y</ti>
</tr>
<tr>
<th>CONFIG_PAX_MEMORY_UDEREF</th>
<ti>Y</ti>
<ti>N</ti>
</tr>
</table>
<p>
For the host, however, one must disable both CONFIG_PAX_KERNEXEC and
CONFIG_PAX_MEMORY_UDEREF. Either of these will set an invisible kernel
option, CONFIG_PAX_PER_CPU_PGD, which is know to break kvm. What is actually
happening is that the guest's performance is degraded to the point where it is
unusable, but doesn't crash, and the host is left with qemu-kvm in
uninterruptible sleep (state D when doing ps aux). Only rebooting the host
clears the issue.
</p>
<p>
These tests were done using the 2.6.32 and 2.6.34 branches of the kernel with
GRSEC/PaX patch version 2.1.14 and 2.2.0 (see Gentoo bug <uri
link="https://bugs.gentoo.org/328623">#328623</uri>). However, it unlikely that
this problem will be solved anytime soon, which is unfortunate because both
KERNEXEC and UDEREF are excellent hardening features.
</p>
</body>
</section>
<section>
<title>Hardening Xen</title>
<body>
<p>
Xen is an older virtualization technology than kvm, but similar in many
regards. It employs a hypervisor which boots a specialize host's kernel
(dom0). Once the host is up, it in turn runs guests (domU) ... TODO
</p>
<!-- TODO Complete this part -->
</body>
</section>
<section>
<title>VMWare Workstation</title>
<body>
<p>
VMWare Workstation needs to link precompiled binaries against system
libraries in order to function. Because Gentoo Hardened uses more secure
functions of GCC, VMWare Workstation cannot link against it. Because
VMWare Workstation cannot link, it does not function. In fact, using
VMWare Workstation at all on Hardened Gentoo led to a hard system reset.
</p>
</body>
</section>
</chapter>
<chapter>
<title>Resources</title>
<section>
<body>
<p>
KVM related resources:
</p>
<ul>
<li><uri link="http://en.gentoo-wiki.com/wiki/KVM">Setting up KVM on Gentoo
Linux</uri></li>
<li><uri link="http://www.linux-kvm.org/page/Virtio">Using Virtio Drivers in
Linux</uri></li>
</ul>
</body>
</section>
</chapter>
</guide>
|