From owner-freebsd-virtualization@FreeBSD.ORG  Thu Nov 21 14:12:41 2013
Return-Path: <owner-freebsd-virtualization@FreeBSD.ORG>
Delivered-To: freebsd-virtualization@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits))
 (No client certificate requested)
 by hub.freebsd.org (Postfix) with ESMTPS id 48A60AB9
 for <freebsd-virtualization@freebsd.org>; Thu, 21 Nov 2013 14:12:41 +0000 (UTC)
Received: from mail-vb0-x234.google.com (mail-vb0-x234.google.com
 [IPv6:2607:f8b0:400c:c02::234])
 (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits))
 (No client certificate requested)
 by mx1.freebsd.org (Postfix) with ESMTPS id 08D002A2E
 for <freebsd-virtualization@freebsd.org>; Thu, 21 Nov 2013 14:12:40 +0000 (UTC)
Received: by mail-vb0-f52.google.com with SMTP id f13so913554vbg.39
 for <freebsd-virtualization@freebsd.org>; Thu, 21 Nov 2013 06:12:40 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113;
 h=mime-version:in-reply-to:references:date:message-id:subject:from:to
 :cc:content-type;
 bh=wAY8vMW0Mf2zjwogpU0vE2FugGW2f9mNgP277fhDMro=;
 b=zWXv8FcBHD1T06SlmG4KtR9aM64OPYYs5nw/7N5Ok+UnVvemZlI1IhIvQp4Nx2GCAq
 d5UZ3dak9AHkqGtL2CAsgKtuOFlc9poixAN32XhuJwvt/juETnx+SS6d/qbyXDhYrZUS
 2m444+Fa4c+z1cNNLMBCT//Ldxcd1E79tbYYp95C1wMu9/cR5enwEYU/JELqJWcm0Sav
 eo2wRReV8K2wLVXNKmHA7zaiyBxrSHAoA+8pqjCmMOR1IQYGobVmPd8aeN28A1RKC5dK
 oRBq/LtpYaJPsNFKaZo8fLyvQfjXYE1iM6iBLiIEDQ9A68VgWSGR+Z+2NyiXwuWfL+5G
 HISg==
MIME-Version: 1.0
X-Received: by 10.58.100.244 with SMTP id fb20mr6085911veb.6.1385043160072;
 Thu, 21 Nov 2013 06:12:40 -0800 (PST)
Received: by 10.58.229.137 with HTTP; Thu, 21 Nov 2013 06:12:40 -0800 (PST)
In-Reply-To: <CAF6rxgmkUnyENS=_y-jCjnQdBqgeDX4K2xJh6SSJ=7syss3T=A@mail.gmail.com>
References: <BLU179-W2710DC567151403C38377AC6E60@phx.gbl>
 <CAF6rxgmkUnyENS=_y-jCjnQdBqgeDX4K2xJh6SSJ=7syss3T=A@mail.gmail.com>
Date: Thu, 21 Nov 2013 12:12:40 -0200
Message-ID: <CAGF-nS5Sth20FtS-XGgQf_PkwrKFkCjW0U_SvJEkbxiBg7wX-Q@mail.gmail.com>
Subject: Re: VPS / Jail / Bhyve File System isolation
From: Alexandre Biancalana <biancalana@gmail.com>
To: Eitan Adler <lists@eitanadler.com>
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: quoted-printable
X-Content-Filtered-By: Mailman/MimeDel 2.1.16
Cc: "freebsd-virtualization@freebsd.org" <freebsd-virtualization@freebsd.org>
X-BeenThere: freebsd-virtualization@freebsd.org
X-Mailman-Version: 2.1.16
Precedence: list
List-Id: "Discussion of various virtualization techniques FreeBSD supports."
 <freebsd-virtualization.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/freebsd-virtualization>, 
 <mailto:freebsd-virtualization-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-virtualization/>
List-Post: <mailto:freebsd-virtualization@freebsd.org>
List-Help: <mailto:freebsd-virtualization-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-virtualization>, 
 <mailto:freebsd-virtualization-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Thu, 21 Nov 2013 14:12:41 -0000

On Thu, Nov 21, 2013 at 12:48 AM, Eitan Adler <lists@eitanadler.com> wrote:

> On Wed, Nov 20, 2013 at 12:55 PM, Bruno Lauz=E9 <brunolauze@msn.com> wrot=
e:
> >
> > Using jails, customers are uncomfortable with the fact documents can be
> accessed from the host with root access.Project VPS seems to isolate more
> the guest from the host but not as well as an hypervisor like bhyve. With
> an hypervisor what the client have is private, as long as the host can
> manage the disk, delete it,  but the information is kept private from the
> host.
> > Any suggestions how to offer jail, vps, or anything containers
> techniques with total file system isolation from the host, or the only wa=
y
> is to go hypervisor, with the performance and instances count penalty tha=
t
> goes with it?
>
> Untrusted hypervisors is an active area of academic research.
> However, any such scheme requires additional hardware support.
>
> If you are interested I can give you some papers to look at.


I'm interested, can you provide the links of the papers ?