Groups | Search | Server Info | Login | Register

Groups > gnu.hurd.help > #354

Re: Combining Hurd and Qubes OS for security reasons? Possible?

Show all headers | View raw

Hello,

David Renz, on Fri 18 Dec 2015 19:26:53 +0100, wrote:
> E. g., there are  so-called 'ACPI'- or 'BIOS-Rootkits', which are capable of manipulating
> Windows as well as Linux systems. Since Hurd follows a different approach of
> accessing hardware components, I often wondered whether this could make it
> resistent against those kind of rootkits,

It will most probably be resistent to windows- and linux-oriented
rootkits, since the implementation is different.  If there are flaws in
the ACPI implementation of GNU Mach, there are probably ways to rootkit
it.  GNU Mach however currently uses ACPI only for shutting the system
down, so the exposure is low.  We'd however need it to eventually work
with multicore processors.

> Wouldn't it potentially increase one's security by many times, if one would be
> able to let (e. g.) Debian Hurd as a template VM on top of a Qubes OS system?

Well, that'll replace the GNU Mach ACPI implementation with the Xen
implementation, i.e. trading one security surface by another. Since the
Xen one is well-tested, that can be a good trade :)

> I'm sure it would be really difficult to put this idea into practice, but
> basically this should be possible to do, or am I missing a fact which make this
> be impossible?

GNU Mach is already ported to Xen, so it should be fine with Qubes.

Samuel

Back to gnu.hurd.help | Previous | Next | Find similar

Thread

Re: Combining Hurd and Qubes OS for security reasons? Possible? Samuel Thibault <samuel.thibault@gnu.org> - 2015-12-19 23:28 +0100

csiph-web