6

It seems that every time I have a new 'binge' at using the likes of VirtualBox or VMWare (the Type II version), they've introduced even more high-level features, often ones that remove layers between guest OSes and the host system. They realised early on that emulating the x86 was too slow, so they pretty much gave the CPU directly to the guest VM. They then realised that giving direct access to DirectX and OpenGL would increase performance, so they granted direct access to that too. Then they added more desktop integration, more seamless copy-and-pasting, etc. It goes on.

So, whilst Type II hypervisors are granting lower and lower-level direct access as well as more high-level desktop integration, so often are the applications running within the guests: before, DirectX and OpenGL was the darling of game developers, but now even web browser developers can't keep their mitts off it. So even things like web browsers are using functionality that is being 'handwaved' through the sandboxing layer of the hypervisor.

Is this trend turning type II hypervisors more into 'enablers of co-inhabiting OSes', and if so, should we be concerned at the weakened sandbox this presents?

Louis Jackman
  • 463
  • 2
  • 10
  • 1
    Related: [Is OpenGL a security problem?](http://security.stackexchange.com/questions/35634/is-opengl-a-security-problem) – Adi Jul 18 '13 at 14:30

1 Answers1

4

If you want to use virtual machine as a sandbox mechanism to contain potentially hostile software, then indeed all the kinds of shortcuts you talk about are a source of worry. However, note that these "enablers" all apply to desktop-related virtualization. Most users of virtualization on their desktop systems do not do that for security, but for functionality: typically, being able to run Windows applications on a Linux or MacOS X system.

Most "big" users of "sandboxing virtualization" (where the containment is intended as a security feature) are on the server side, where there is no question of OpenGL or desktop integration, since there is no desktop and no graphic card worth speaking of.

The people who have to worry are then security researchers who analyse malware on their desktop systems. If (when) I indulge in such activities, then I tend to use Xen rather than VirtualBox: though the latter is easier to configure and manage on a desktop, it also does a lot of things automatically, that I would prefer to keep contained. Xen with the "xl" toolstack is barebone, but at least I can know what happens (i.e. nothing happens until I activate it explicitly).

Thomas Pornin
  • 320,799
  • 57
  • 780
  • 949