Tag Archives: process

Updates to Xen Project Security Process

lockBefore Christmas, the Xen Project ran a community consultation to refine its Security Problem Response Process.  We recently approved changes that, in essence, are tweaks to our existing process, which is based on a Responsible Disclosure philosophy.

Responsible Disclosure and our Security Problem Response Process are important components of keeping users of Xen Project-based products and services safe from security exploits. Both ensure that products and services can be patched by members of the pre-disclosure list before details of a vulnerability are published and before said vulnerabilities can be exploited by black hats.

The changes to our response process fall into a number of categories:

  • Clarify whether security updates can be deployed on publicly hosted systems (e.g. cloud or hosting providers) during embargo
  • Sharing of information among pre-disclosure list members
  • Applications procedure for pre-disclosure list membership

The complete discussion leading to the changes, the concrete changes to the process, and the voting records supporting the changes are tracked in Bug #44 -Security policy ambiguities. On February 11, 2015, the proposed changes were approved in accordance with Xen Project governance. Note that some process changes are already implemented, whereas others are waiting for implementation tasks (e.g. new secure mailing lists) before they can fully be put in place. We have however updated our Security Problem Response Process as the most important elements of the process are already in place.

Process Changes Already in Operation

The updated policy makes explicit whether or not patches related to a Xen Security Issue can be deployed by pre-disclosure list members. The concrete policy changes can be found here and here. In practice, every Xen Security Advisory will contain a section such as:

DEPLOYMENT DURING EMBARGO
=========================

Deployment of the patches and/or mitigations described above (or
others which are substantially similar) is permitted during the
embargo, even on public-facing systems with untrusted guest users and
administrators.

Predisclosure list members who wish to deploy significantly different
patches and/or mitigations, please contact the Xen Project Security
Team.

This section will clarify whether deploying fixed versions of Xen during the embargo is allowed. Any restrictions will also be stated in the embargoed advisory. The Security Team will impose deployment restrictions only to prevent the exposure of security vulnerability technicalities, which present a significant risk of vulnerability rediscovery (for example, by visible differences in behaviour). Such situations have been, and are expected, to be rare.

Changes to Application Procedure for Pre-disclosure List Membership

We also made additional changes related to streamlining and simplifying the process of applying for pre-disclosure list membership. Detailed policy changes can be found here and here. Moving forward, future applications to become members of the Xen Project pre-disclosure list have to be made publicly on the predisclosure-applications mailing list. This enables Xen Project community members to provide additional information and also is in line with one of our community’s core principles: transparency. In addition, we’ve clarified our eligibility criteria to make it easier for the Xen Project Security Team, as well as observers of the mailing list, to verify whether applicants are eligible to become members of the list.

Process Changes Not Fully Implemented:  Sharing of Information Among Pre-disclosure List Members

Finally, members of the pre-disclosure list will be explicitly allowed to share fixes to embargoed issues, analysis, and other relevant information with the security teams of other pre-disclosure members. Information sharing will happen on a private and secure mailing list hosted by the Xen Project.  Note the list is not yet in place; more details here.

Xen Project Security Policy Improvements: Get Involved

The recent XSA-108 vulnerability resulted in a lot of media coverage, which ended up stress-testing some of our policy and security related processes. During the embargo period of XSA-108, the Xen Project Security Team was faced with some difficult questions of policy interpretation, as well as practical issues related to pre-disclosure list membership applications.

To ensure more clarity moving forward, the Xen Project Security Team started a community consultation to improve and better define the project’s Security Vulnerability Response Process. In particular we are seeking to clarify the following elements of the policy, which surfaced during the embargo period of XSA-108:

  • Sharing of information amongst pre-disclosure list members during an embargo period
  • Deployment of patches on public systems of fixed versions of the Xen Project Hypervisor during the embargo period
  • Service announcements to non-list-member users during an embargo period
  • Clarifying criteria related to pre-disclosure list membership and making it easier to verify them
  • Processing applications of pre-disclosure list membership during an embargo period

For more background and information read the e-mail thread on xen-devel@ called Security policy ambiguities – XSA-108 process post-mortem (also see here to see the entire conversation thread in one place).

If you use Xen Project Software in any way, we encourage you to voice your thoughts to help formulate and update our security policy to ensure it meets the needs of our entire community. To take part in the discussion please send mail to xen-devel@lists.xenproject.org. If you are a member of the list just reply to the relevant thread. If you are not a member of the mailing list and plan to respond to an e-mail that has already been sent you have two easy options:

  • You can reply to the message via our issue tracker using the Reply to this message link at the top of the message; or
  • Retrieve the mbox from the issue issue tracker, load the thread into your mail client and just reply.

Even if you chose not to subscribe to xen-devel@ – which you don’t have to participate – you may want to occasionally check the discussion thread activity on this thread, to ensure you are not missing any activity.

Going forward, we will collate community input and propose a revised version of the policy, which will be formally approved in line with Xen Project Governance. We have not set a specific deadline for the discussion, but aim to issue a revised policy within 4 weeks.

Save 50%: Learn About The Next Wave of Virtualization at Xen Project User Summit, Sept 15 in New York City

[Originally post on Linux.com]

Some claim that the age of virtualization is now past.  However, nothing could be farther from the truth.  And this year’s Xen Project User Summit will highlight many of the newest advances in virtualization.  If you use the Xen Project Hypervisor — or if you are simply evaluating your virtualization alternatives — join us in New York on September 15 at the Lighthouse Executive Conference Center!

Readers of the Xen Project blog can now register at 50% off the original $79 price.  Just use code XenUser50off when you register!

This year’s event focuses on a number timely topics, including:

The New World of Unikernels

Some of the hottest technologies in the world of virtualization are the unikernels.  Small, lightweight, and secure, unikernels will power a new type of cloud.  Allowing for hundreds, or even thousands, of VMs per host, unikernels will allow us to develop exciting new visions of the cloud.  Hear from the creators of such notable entries like OSv and HaLVM.

The Latest about Xen Project in OpenStack and SUSE Cloud

Many organizations are making plans for clouds based on OpenStack.  Now is an excellent time to see how SUSE Cloud can leverage Xen Project software to make those plans become a reality.

New Features Coming in Xen Project 4.5

Some mature projects slow down development as they age.  But not Xen Project!  Our upcoming release has the longest list of new features we’ve seen in years!  Get the lowdown on what changes are coming, so you can start making plans.  Plus, we’ll hear about the latest news from the Board of Advisors.

Improving Security

You can’t get serious about the cloud without addressing security.  Learn about the Advanced Security features of Xen Project as well as the Zazen security architecture.  And hear about the case study describing the deployment of Xen Project-powered security devices.

Upcoming From the XenServer Project

Last summer marked the birth of the Open Source XenServer project.  For years, XenServer has been a very popular commercial product which leverages Xen Project software.  Now learn what’s planned in the next iteration of XenServer.

The Newest From Xen Orchestra

There are a number of other software projects in the Xen Project ecosystem.  One of the most exciting is Xen Orchestra, a web-based GUI for XAPI and XenServer.

The Latest from Xen4CentOS

Last year, Xen Project was re-integrated into CentOS 6 via the Xen4CentOS effort.  Learn how to use Xen4CentOS and hear what’s coming in the new CentOS Virtualization SIG.

And the Future Development for High Availability

There’s plenty more in development at Xen Project.  Still under development is COLO, an effort to bring high availability to VMs using lock-step failover.  Hear about the status of this project while it is still cooking.

All From the Mouths of Industry Leaders and Innovators

Many of our presenters are from industry leaders like Oracle, Intel, Citrix, Red Hat, and SUSE.  But we also have people from up-and-coming organizations like Cloudius Systems, Galois, Vates, Zentific, and Sound Linux Training.

For the schedule and registration information, please visit the Linux Foundation Events website.  And don’t forget the code XenUser50off  when you register!

We hope to see you in New York!

Will you give Xen a ride … or will Xen give you a ride?

And by “a ride”, we actually mean a ride. Like this:

 

8275748195_4a18513755_z

Like, will Xen run in your car?  Well, it appears it will!

It all started with ARM Support

In fact, Xen Project developers started woking on supporting the ARM architecture (with hardware virtualization capabilities) a couple of years ago. The goal was simple: as soon as ARM server are available, it must be possible to run Xen Project software on them. That goal has been achieved, but that is another story!

It is well known that processors employing the ARM architecture are powering already the vast majority of the so called Embedded Systems, ranging from phones, tablets and smart TVs up to cars or even airplanes. But does that mean that at some point we will start to see virtualization capable chips in cars? And if yes, when? The answers to these questions are “Yes” and “really really really soon”! In fact, the Xen Project Hypervisor is uniquely placed to support this new range of use-cases. Its isolation and security features, flexible virtualization mode and architecture, not to mention driver disaggregation and the fact that it now supports ARM (and does it with only ~90K lines of code), make it a perfect fit for the embedded world.

Some Recent ‘History’

Mobile and embedded virtualization on ARM has a long history within the Xen Project, with research projects such as Samsung’s ARM PV port and the Embedded Xen effort. However these projects were mainly research focused. With ARM support becoming a part of the Xen Project Hypervisor last year and various market factors coming together, Xen Project based products are now on the horizon. Last autumn was pivotal in generating momentum for this concept. A number of companies showed real demos and prototypes at our 2013 Developer Summit, such as

  • The Xen Project Hypervisor running on a Nexus 10 (slides and video)
  • The Xen Project Hypervisor powering an in-vehicle infotainment (IVI) system, and other systems on the TI Jacinto 6 automotive platform designed for cars (slides and video).

Since then, momentum has built within the community – as can be seen on xen-devel mailing list discussions – to port embedded OSes to the Xen Hypervisor  (some examples: FreeRTOS, Erika and QNX). Contributions and patches for making The Xen Project Hypervisor work better in such environments started to arrive too, from individuals, research institutions and small and big companies. Among the companies, GlobalLogic Inc., a full-lifecycle product development services company, has made the largest contribution so far, but we must also mention DornerWorks, GaloisUniversity of Washington and Evidence (in collaboration with the University of Modena).

A summary of the past and ongoing activities of this kind is below:

What about now?

On Monday (we told you: “really really really soon” :-D), The Xen Collaborative Project and The Linux Foundation announced a new Embedded and Automotive initiative. Artem Mygaiev, AVP Development at GlobalLogic, will serve as the Embedded and Automotive Project Lead.

The Embedded and Automotive team within The Xen Project intends to build a platform around the Xen Hypervisor that enables using it for all the non-data center use cases (automotive, internet TV, mobile, etc.) by providing a community focal-point within the Xen Project community as well as within the wider open source community.

The team plans to:

  • develop and upstream necessary changes to The Xen Project Hypervisor and Linux
  • implement new drivers (such as GPU, HID, …), protocols, capabilities and functionality that are needed for a complete automotive/embedded/mobile virtualization stack
  • upstream all necessary changes to support such functionality in operating systems that are needed for these use-cases (e.g. Android, Linux, etc.)

For the occasion, Alex Agizim, CTO of Embedded Systems at GlobalLogic, which also is a member of The Linux Foundation Automotive Grade Linux Steering Committee, said:

With ARM support, Xen Project technology is a perfect fit for embedded systems and automotive use. For example, our Nautilus platform, based on The Xen Project virtualization, enables ourin-vehicle infotainment (IVI) and auto manufacturing partners to quickly and cost-effectively develop hybrid Android/Linux-based systems. Using Nautilus, developers are able to run multiple sandboxed OSes on a single System-on-Chip (SOC). This provides superior functionality and security for both infotainment and operational functions within a car.

The latest demo of GlobalLogic‘s Nautilus Platform has been shown at the latest edition of the Automotive Linux Summit, in Tokyo. Check out the video and slides. We also heard about further use cases for Xen Project Software at this week’s Developer Summit. The rate of innovation in our community in this area is staggering: fasten your seat belts! We will tell you about these more in an upcoming event report. All this activity is also creating many benefits for the cloud and traditional server use use-cases. Certification will lead to quality improvements across shared components. Realtime scheduling can be used for graphics and gaming use-cases in the cloud and for Network Function Virtualization. And so on, and so on, …

Learn More

GlobalLogic, in partnership with The Linux Foundation, will present a free webinar at 9 a.m. PDT, Wednesday, August 27, 2014, titled “Virtualization in the Automotive Industry.” Register today to learn how Xen Project technology adds reliability and security when adopting virtualization for automotive software development.

Vendors and individual developers interested in collaborating on embedded, automotive and mobile use cases are encouraged to join the new Xen Project subproject at http://xenproject.org/developers/teams/embedded-and-automotive.html.

Time to Register for Xen Project User Summit on Sept 15, 2014

Great Session Lineup Awaits Attendees in New York City!

xpus-join_us-2014

It’s time to make your travel plans to New York City for the September 15 arrival of the Xen Project User Summit!

The Lighthouse Executive Conference Center will play host to the only full day user-centric Xen Project event on this year’s calendar.  If you are a power user, a new user, or you just want to see what Xen Project can possibly do for you, you’ll want to be there.

Attendees will find an excellent selection of talks waiting for them at this year’s event.

Is Your Head in the Clouds?

We have a number of terrific cloud-related talks on the schedule!

Listen to SUSE‘s Peter Linnell talk about Xen, OpenStack, and the SUSE Cloud.  And are you thinking about unikernels in the cloud?  Adam Wick of Galois, provider of HaLVM, will expound on the virtues of tiny VMs providing a single-purpose operating environment (imagine many of the advantages of Linux Containers but with the security of a real hypervisor).  And Don Marti from Cloudius Systems will talk about using the OSv unikernel to create a C and Java environment directly on the hypervisor.

Or is Security Your Focus?

Then you’ll want to hear about the Zazen security framework as described by Steven Maresca of Zentific.  Plus, there’s my talk discussing the Advanced Security Features of Xen Project, most of which are easy to use, but most users don’t even seem aware of them.

Is Your Mind on the Future?

That’s good, because Oracle‘s Konrad Wilk, the Release Manager for the upcoming 4.5 Xen Project Release, will give us the run down of the features to expect.  There’s an impressive list of improvements in the works, so Konrad will help us to understand what is likely to make the cut.  And our own Community Manager Lars Kurth from Citrix will give us a healthcheck on the project itself, including fascinating information about how diverse our development ecosystem has become in the past few years.

Or Maybe Distribution Support is Your Thrust?

You’ll want to hear Johnny Hughes of the CentOS Project discuss the Xen4CentOS effort with a quick and easy cookbook for restoring our favorite hypervisor to the CentOS world.  He will also address how the effort has given birth to the new CentOS Virtualization SIG with an eye on making CentOS a key platform for all types of virtualization technologies.

Could XenServer be Your Concern?

If so, then you will want to hear XenServer Community Manager Tim Mackey discuss where XenServer has gone in the year since it became Open Source — and, more importantly, where it is expected to go from here.  And you will definitely want to hear from Olivier Lambert of Vates as he discusses the Xen Orchestra project, an interface for controlling XenServer and XAPI installations from a web-based interface.

Or High Availability?

Then you’ll definitely want to hear Will Auld of Intel discuss the COLO project.  Still in development, COLO aims to create lock-step VMs to deliver non-stop availability during a VM failure.  This is critical capability when you have a VM which needs to keep running no matter what.

Or Deployment?

Don’t miss Grant McWilliams‘ talk about deploying XAPI-based security devices.  It is actually an amazing tale describing the design and deployment of some amazing devices using the Xen Project Hypervisor to make magic happen.

Then You Need to Register Today!

For just $79 — less than the price of a good dinner in Manhattan — you can get all this, plus the User Jam Session.  User Jam is your time to give feedback about the project and the presentations given.

And tell a coworker to sign up, too!  We have two tracks most of the day, so bring a friend who can go to the sessions you can’t.

See the full schedule and register on the Linux Foundation website:

And we hope to see you in New York City on September 15!

Call For Participation is Open for the Xen Project User Summit in New York City

Our Next User Summit to be Held on September 15 in Downtown Manhattan

Last year marked the arrival of the very first Xen Project User Summit.  This year, we are aiming to draw over 100 people to the Lighthouse Executive Conference Center in the heart of New York City to discuss the use of the Xen Project hypervisor.

How Are You Using Xen Project Software?

We are actively looking for people who are willing to talk about:

  • How you use our project’s software in your datacenter or lab
  • How you integrate the Xen Project hypervisor in your solution or cloud
  • How you control the software with custom scripts or utilities
  • Why you chose Xen Project software instead of some other hypervisor
  • How much you time or money you saved by using our software
  • Where you’d like to see our project go in the future

Also, we’d welcome talks about:

  • Features of the newest release and how to use them
  • New projects building on Xen Project software which could open new avenues for end users (like the work around GPU virtualization, cloud operating systems like MirageOS, and additional architectures like ARM)
  • Instructive HowTo sessions to educate attendees about implementing particular capabilities within the software
  • The use of related products and projects like XenServer and Xen Orchestra to make our software even more powerful in the datacenter

This promises to be one of the best opportunities for users and integrators to come together and learn from people who have plenty of insight into using Xen Project software.  This may be the best chance all year to become educated about the hypervisor and the subprojects.

We are Waiting for Talk Proposals from You!  Respond by May 31.

The submission deadline is May 31, 2014.  Go to the event’s CFP page on the Linux Foundation’s website to submit your talk proposal.

Continue reading