Linux Virtualization Based Security
Talkat Linux Security Summit North America 2024 · on Thursday, 2024-04-18· at 14:00· Terrace Suite 1+2·
summary
Linux Virtualization Based Security builds a minimal VTL1 secure kernel (a tiny Linux) via Hyper‑V VSM to enforce immutable EPT permissions and register pinning so kernel code and key data stay untampered even if the guest kernel is later compromised. It uses the HEKI memory framework, hypercalls before init to lock protections, and hypervisor intercepts for violations. Demo shows an IDTR attack blocked on 5 CPUs (successful without LVBS, panics with LVBS). Future work: module authentication, trustlets, confidential‑VM integration.
AI-written summary · about
chapters (10)
- 0:00Introduction and motivation
- 3:51Architecture overview
- 5:23Virtual secure mode features
- 6:49Software architecture design
- 8:10Threat model and implementation
- 24:59Register pinning techniques
- 26:50Exception and fault handling
- 29:31Live technology demo
- 35:40Future work and roadmap
- 37:10Q&A and discussion
related talks
50mLinux Virtualization Based Security (LVBS)
32mLVBS and Advanced Kernel Integrity
48mBooting a Linux Kernel in a Higher Privilege Level
23mHyper-V's Virtual Secure Mode in KVM project update
26mHypervisor Based Integrity: Protect Guest Kernel in Cloud
12mSecurity and Performance in the Delegated User-level Virtualization
39mHeki: Hypervisor-Enforced Kernel Integrity for Linux with KVM
20mIntel Virtualization Technology Extensions to Enable Hardware Isolated VMs