Thanks for your reply. I made some suggestions for KVM and QEMU below. Also I was wondering what your POV is on my thoughts: https://news.ycombinator.com/item?id=14227605 https://news.ycombinator.com/item?id=14228563
I'm still rooting for KVM because it has the best hardware compatibility, it in mainline and its performance is the best. However the security situation with QEMU is not as rosy as some of you portray it (and its not as…
My logic is: Without a hardened kernel, LSM can be trivially bypassed and seccomp seems to whitelist everything under the sun. This only leaves us with QEMU code quality to rely on. Since Grsec is not longer available…
@rwmj can you please point to the list of white-listed QEMU-KVM devices used in RHEL?
Thanks for your reply. I made some suggestions for KVM and QEMU below. Also I was wondering what your POV is on my thoughts: https://news.ycombinator.com/item?id=14227605 https://news.ycombinator.com/item?id=14228563
I'm still rooting for KVM because it has the best hardware compatibility, it in mainline and its performance is the best. However the security situation with QEMU is not as rosy as some of you portray it (and its not as…
My logic is: Without a hardened kernel, LSM can be trivially bypassed and seccomp seems to whitelist everything under the sun. This only leaves us with QEMU code quality to rely on. Since Grsec is not longer available…
@rwmj can you please point to the list of white-listed QEMU-KVM devices used in RHEL?