Attack Surface: Why I Unikernel, Part 1

http://www.somerandomidiot.com/blog/2014/08/11/attack-surface-area/

by luu • 12 years ago

66 37 12 years ago

Breaking news: Hipster bloggers use all-organic artisanal application stacks to replace an operating system with a smaller, more intimate operating system that thinks the 90s were just so cool, man, even if they have to spend all their time to reinvent the wheel without any obvious benefit. Film at 11.

dmytrish• 12 years ago

Do you have objections against the attack surface argument?

Do you think that running a full-blown OS in a virtual machine is much better than a small dedicated OS? Do you think that overhead of userspace isolation is justified for a single task in a virtual machine?

peterwwillis5• 12 years ago

Sure.

First of all, lowering attack surface is the least intelligent way to improve security. It's like you have a house with a lot of windows that people could break into, so you cut the house in half to reduce the number of windows. What works much better than that is auditing and hardening the security of the house and its windows and making strategic decisions about how they work.

For example, many people argue you should remove compilers from your system so attackers can't compile exploits on the host. But now the attacker can just push code there, or try a bunch of code in trial-by-error.

Other people argue that any piece of software that isn't necessary should be removed, in case one of them has a vulnerability that could be used against you. Those vulns (for example, priv escalation vulns) could be eliminated by a simple audit of permissions, MAC rules or hardening patches, which would also drastically increase the overall security of the system. But people pick what appears like a simple solution because they don't want to think about it.

I think you use the tool that works for your use case.

If you were designing flight control software for the space shuttle, a whole virtual machine + OS might be overkill for your application, because you have a very specific set of operations to deal with and you need it done in a very specific environment, and you probably won't need to dynamically allocate extra resources in the middle of flight.

On the other hand, if you're just serving static http content, your requirements are very minimal so you can use just about anything. Any OS, any web server, any content provider, any security configuration, etc. Due to its very narrow set of operations and few requirements, it's really easy to secure no matter what you use.

In this guy's case he could have just read a book on SELinux and written a policy for a ridiculously secure web host over a weekend. Instead he's using some obscure bleeding-edge pseudo-operating system which he'll probably never use for anything else once he realizes how impractical it is, and getting marginal (if any) security benefit. He even admits he DoS'd it by accident. The only reason he's doing this is he thinks it's retro and cool.

zem3• 12 years ago

did you even read the post? she spent several paragraphs talking about the attack-resistance benefits running on a unikernel provided.

also, when did people here start looking down on hacking for the sheer joy of it? personally, i found this post pretty inspiring; i've been looking for people who are doing stuff with mirage other than hacking on mirage itself.

x0x0• 12 years ago

Which is still less secure than running her static site straight out of s3.

killnine• 12 years ago

The point was indeed tainted by attitude, but a solid discussion point none the less.

zem3• 12 years ago

it's not really a discussion point, it's sneering at people for "reinventing the wheel", when the entire point of mirageos is to start from scratch and try to make a better wheel. i'm really having a "how do other people not find this as exciting as i do?!" moment here.

bitwize• 12 years ago

Unikernels are pretty much the future of cloud deployment. Why even bother with all the pieces a standard OS distro comes with when you can compile and link together only the things you need to run your specific application? Deployment and configuration are a breeze, the atrack surface us reduced and so is the total amount of code running and the OS image size. See also the work the NetBSD devs have been doing with building unikernels out of rump kernel drivers.

Oh, and you should really be eating paleo, local, and organic.

wmf• 12 years ago

CoreOS + Docker (with minimal images) also provides those characteristics but feels less alien.

mercurial3• 12 years ago

Is "hipster" the new Godwin point nowadays?

0xdeadbeefbabe• 12 years ago

Nah, hipster rhetoric didn't fool enough people.

But using the word is a good way of introducing a joke.

tedunangst2• 12 years ago

Also, the how: http://www.somerandomidiot.com/blog/2014/08/18/i-am-unikerne...

acqq8• 12 years ago

Thanks! It's a "high-level summary" of all necessary steps needed to host the site with the described technologies. Reading it:

"I start up the build host, then once it’s responding, I scp my unikernel, mir-www.xen, over to its filesystem. The blog is currently about 17 megabytes (mostly high-resolution embroidery photos), so this is starting to take a while; soon I’ll have to do something smarter."

"Each deployment makes a 1GB snapshot, so soon I’ll have enough snapshots on EC2 that I’ll have to go in and delete a few."

What's the size of the final binary that actually runs? 17 MB or 1 GB?

mje__• 12 years ago

The smallest EBS snapshot you can create is 1GB

vec• 12 years ago

So what's the advantage of doing this over just using S3/CloudFront static hosting? In either case your attack surface is essentially that of AWS itself and S3 hosting seems like it would be much simpler (and almost certainly much cheaper).

lbotos• 12 years ago

In theory you can use a unikernel to run a rails app, python app, etc. This post uses static sites as the example but I think it's more of a "prep" than the end all be all use.

mercurial3• 12 years ago

I don't think Mirage is quite mature enough for that yet, but eventually, it should be possible to run at least an Ocsigen/Eliom (OCaml web framework) on it.

acqq8• 12 years ago

The background:

"Unikernels: Rise of the Virtual Library Operating System"

http://queue.acm.org/detail.cfm?id=2566628

It got only a few comments on HN 116 days ago: https://news.ycombinator.com/item?id=8025493

zokier• 12 years ago

How does his setup compare to running the blog in a minimal (ie not full distro based) Docker container?

acqq8• 12 years ago

Her setup is based on the unikernel which is practically "a custom minimal OS doing only one thing," having only Xen under. Knowing that Xen is under it it doesn't even have to have to customize the drivers for the different hardware -- Xen does that. Docker container has a bunch of regular stuff which runs on Linux, but separated from the other stuff.

breischl• 12 years ago

Very cool idea. It actually reminds me of how the Azure PaaS offering (Web & Worker Roles) work - you just send up the code you want to run and they run it. It's different than the unikernel because under the covers Azure is running a full Windows OS, but from a user perspective it's not all that different.

crazytony• 12 years ago

Seems like an ok 'Hello, Unikernel' article if a bit forced but her point about bots mining on AWS actually undermines her deployment strategy: the miners have been compromising AWS credentials/security NOT boxes hosted on AWS. They don't want your little t2.micro instance running a static server. They startup new c3.8xlarge instances and deploy their software.

She's still hosting this thing in AWS so she's still vulnerable and no amount of Unikerneling is going to save her from that attack vector.

Sorry for the pun and creating a verb out of a noun.

Someone• 12 years ago

No apologies are needed. In English, you can verb any noun (http://en.m.wiktionary.org/wiki/Citations:verb)

sp332• 12 years ago

Today's xkcd http://xkcd.com/1443/

krick• 12 years ago

While obviously overkill to run a small blog it certainly feels tempting. If could be efficiently automated surely it is worth a try.

However, what I'm more interested in is how Mirage works for, say, more practical tasks. It is quite some time already after it came up the first time, there were few blog posts about how to do this or that on Mirage OS, yet I never saw any real benchmarking. Is Mirage more/less/about-the-same effective in serving static content than nginx on Linux? Is it any worse/better than CloudFron static hosting for that purpose? How about real apps on multiple nodes using Mirage? How about it performing on ARM (as I understand that's still largely an experiment, but anyway, it is interesting enough topic to talk about)? Never saw an analysis of it by any actual security professional as well. Essentially speaking, I'm a bit upset that such an interesting project gathers somewhat less attention than, it feels to me, it should.

Attack Surface: Why I Unikernel, Part 1

Related Stories