Whilst I like getting more control of my hardware, I really prefer if I can contain arbitrary software - sandbox it and compartmentalise it. If arbitrary processes can own your whole system, is anyone truly an owner?
Whilst I like getting more control of my hardware, I really prefer if I can contain arbitrary software - sandbox it and compartmentalise it. If arbitrary processes can own your whole system, is anyone truly an owner?
This requires access to hardware registers, so it won't work as non-root or inside a VM.
You probably misunderstood the technical writeup (if you read it). This is modifying MMIO registers of the DRAM controllers. Normal user space (ring 3) doesn't have access to that. Nor does a VM guest. This needs host kernel level access to begin with. And that is the layer that should be in complete control of the system. There shouldn't be a hidden OS underneath that I can't replace.
So you might like Qubes OS, which isolates all apps into hardware-assisted VMs. You will still have all the access from the AdminVM, but arbitrary processes won't.
I am using Qubes already ;^)
So you've got nothing to worry about except things like this: https://forum.qubes-os.org/t/qsb-116-multiple-xen-issues-xsa...