From owner-freebsd-virtualization@FreeBSD.ORG Sat Feb 8 21:07:56 2014 Return-Path: Delivered-To: freebsd-virtualization@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id C22D8A84 for ; Sat, 8 Feb 2014 21:07:56 +0000 (UTC) Received: from mail-pa0-x233.google.com (mail-pa0-x233.google.com [IPv6:2607:f8b0:400e:c03::233]) (using TLSv1 with cipher ECDHE-RSA-RC4-SHA (128/128 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 8CF4B1F5A for ; Sat, 8 Feb 2014 21:07:56 +0000 (UTC) Received: by mail-pa0-f51.google.com with SMTP id ld10so4625041pab.38 for ; Sat, 08 Feb 2014 13:07:56 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20120113; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=QgugwZcOvr5+64c4uFVxjuLj36cyJOBfH1Xzo9Ag2/k=; b=w16o4F3j2pou1yfV3rEAlVgGQuw5M5wxorcnKPK72Fc+k5FTQ0YPg3oktMHIFkawlT 5+WhJHYDuZKHbnkzAjkxnblW+CeuQmdrK56NkEFiz9JPXwxtC/cJzjia/DaQxOnhO+Y8 uU1Lq4eaihSFyjPjC0Im825VVTTW7VoSrmD5vzi9K7TnVgMo9oa2i0x2DT3HpzEQ590M FSEPqcLrbbRGFgQ7PXZIrtKy7OMzCwBgBuiuNZbVaVGYk5FyCDEN8CHZhbhxbjfaQufg bUHRmUyIl9RSJBGq1QULZ4BvnKjwLgfLc6aXyHWfXBz476q5JMhdSnVYsXVbb7cr9oH2 kTtw== MIME-Version: 1.0 X-Received: by 10.66.27.72 with SMTP id r8mr16036753pag.62.1391893676145; Sat, 08 Feb 2014 13:07:56 -0800 (PST) Received: by 10.70.92.71 with HTTP; Sat, 8 Feb 2014 13:07:56 -0800 (PST) In-Reply-To: References: <52F5363D.8040102@freebsd.org> Date: Sat, 8 Feb 2014 15:07:56 -0600 Message-ID: Subject: Re: Report of my virtual network lab migrated from virtualbox to bhyve From: Adam Vande More To: Aryeh Friedman Content-Type: text/plain; charset=ISO-8859-1 X-Content-Filtered-By: Mailman/MimeDel 2.1.17 Cc: FreeBSD virtualization X-BeenThere: freebsd-virtualization@freebsd.org X-Mailman-Version: 2.1.17 Precedence: list List-Id: "Discussion of various virtualization techniques FreeBSD supports." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 08 Feb 2014 21:07:56 -0000 On Sat, Feb 8, 2014 at 2:57 PM, Aryeh Friedman wrote: > > > > On Sat, Feb 8, 2014 at 3:54 PM, Adam Vande More wrote: > >> >> On Sat, Feb 8, 2014 at 2:14 PM, Aryeh Friedman wrote: >> >>> >>> It sounds almost identical to the qcow2 security issue being discussed >>> on qemu-devel@qemu.org recently. This might be a *HUGE* win for bhyve >>> then in considering that it's default format is raw (should ahci-hdd be the >>> default?). devel/qemu (not sure about -dev) uses qcow2 as a default and >>> when playing with it on other OS's I found that it seemed to default to >>> that also. It is my understand that most of the open source cloud >>> platforms use qcow2 as their default also (I remember this from an attempt >>> to install openstack grizzly last summer... I have not checked havana >>> though... can any of the freebsd-openstack confirm this?). >>> >> >> I don't consider it a huge win because the possibility of using an >> insecure device precludes it. Someone high on the tree bhyve needs to >> confirm or deny this otherwise it is unsafe to recommend bhyve >> or petitecloud. No offense intended, I really hope it succeeds and will >> likely use it if it does. I cannot use anything which leaves the host >> open. I am also unclear on how bhyve bypasses GEOM which *should* prevent >> any of the symptoms discussed. >> > > The point was that raw has no issue and this is the default for both bhyve > and petitecloud (to avoid certain list politics I didn't mention it by name > before). Sparse is the issue and thus qemu, openstack and cloudstack (as > well as likely vbox) are a problem. > Yes but bhyve *supports* other backing devices than raw correct? Then this really bad. I don't want a politics game either, just saying you won't get adoption until security is clear. I have no problem with you mentioning petitecloud. Indeed I think you should but others may disagree. In your opinion are ZVOL's a good option? -- Adam