Do you remember Joanna Rutkowska, the security researcher behind the controversial BluePill attack against hypervisors?
The company she founded and currently controls, Invisible Things Lab, just launched an open source project dubbed Qubes.
Pitched as a new operating system, Qubes really is a client hypervisor based on Xen, which isolates multiple environment in dedicated Linux-based virtual machines.
The architecture has some interesting characteristics. For example the networking subsystem has been moved from the dom0 to a a dedicated, unprivileged VM that leverages the most modern I/O virtualization techniques (AMD IOMMU and Intel VT-d). The same thing is planned for the storage subsystem in a future release.
Additionally, all end user VMs are linked clones of the same golden image, the only one that needs to be updated.
The applications inside each VM are glued together through the seamless window capability offered by the X Window System, plus secure copy and paste and file sharing, so that the end user doesn’t necessarily have to switch between guest OSes (Fedora 12 64bit is the recommended system for Dom0).
Last but not least, in future releases, Qubes will leverage Intel Trusted Execution Technology (TXT) to secure the system boot.
Of course Invisible Things Lab has to face all the technical challenges that other vendor selling or developing client hypervisors are facing. And the list includes startups like Virtual Computer and Neocleus and leading virtualization players like Citrix and VMware (both in late because of those technical challenges).
Besides technical issues there are security-wise design issues that may partially limit the usability of this platform for some common tasks: for example the company decided to not support OpenGL primarily for security reasons and thus 3D applications won’t perform too well.
Nonetheless the alpha code just released online is already usable and the company plans to deliver a GA version within the end of 2010.
Support for Windows virtual machines may be provided at a future time through a commercial implementation of Qubes.