Linux Virtualization Based Security (LVBS)
summary
Proposal and prototypes for Linux Virtualization Based Security (LVBS) implement hypervisor-backed kernel protections with a hypervisor-agnostic common layer and two reference drivers: Hyper‑V VSM (VTL1 secure kernel running a minimal Linux) and KVM plugins. Working features include control-register pinning, EPT-based memory permission enforcement (separate kernel/user execute bits), and module authentication moved toward the secure environment. Code and a secure-kernel prototype live on GitHub, the project aims to upstream pieces incrementally, and the implementations currently run as prototypes though not all policies are finished.
AI-written summary · about
chapters (4)
related talks
47mLinux Virtualization Based Security
32mLVBS and Advanced Kernel Integrity
48mBooting a Linux Kernel in a Higher Privilege Level
12mSecurity and Performance in the Delegated User-level Virtualization
42mProtecting the Linux Kernel from Confidential Computing Threats in Virtual Environments
26mHypervisor Based Integrity: Protect Guest Kernel in Cloud
19mA Linux Bus for SVSM Services: Build New, Reuse VIRTIO, or Both?
27mPowerVM Platform Keystore - Securing Linux Credentials Locally