本帖最后由 ghfujianbin 于 2012-7-31 11:08 编辑
大体介绍：
Qubes implements Security by Isolation approach. To do this, Qubes utilizes virtualization technology, to be able to isolate various programs from each other, and even sandbox many system-level components, like networking or storage subsystem, so that their compromise don’t affect the integrity of the rest of the system.
Qubes lets the user define many security domains implemented as lightweight Virtual Machines (VMs), or “AppVMs”. E.g. user can have “personal”, “work”, “shopping”, “bank”, and “random” AppVMs and can use the applications from within those VMs just like if they were executing on the local machine, but at the same time they are well isolated from each other. Qubes supports secure copy-and-paste and file sharing between the AppVMs, of course.
主要特点：
- Based on a secure bare-metal hypervisor (Xen)
- Networking code sand-boxed in an unprivileged VM (using IOMMU/VT-d)
- No networking code in the privileged domain (dom0)
- All user applications run in “AppVMs”, lightweight VMs based on Linux
- Centralized updates of all AppVMs based on the same template
- Qubes GUI virtualization presents applications like if they were running locally
- Qubes GUI provides isolation between apps sharing the same desktop
- Storage drivers and backends sand-boxed in an unprivileged virtual machine(*)
- Secure system boot based on Intel TXT(*)
(*) Indicates feature that is planned for future releases, currently not implemented.
官网：http://qubes-os.org/Home.html
Qubes的最大优点就是安全。它充分利用了虚拟化技术（基于安全虚拟机Xen），所有用户应用程序都运行在AppVM（基于Linux的轻量级虚 拟机）中，彼此隔离。而联网代码使用IOMMU/VT-d放在一个非特权虚拟机中，在特权域 (dom0) 中没有任何联网代码。许多系统级组件放在沙盒中，以避免互相影响。
具体中文介绍参考cnbeta：http://www.cnbeta.com/articles/108318.htm
开发者 - 波兰著名女黑客 - Joanna Rutkowska：
|
发表于 2012-7-31 11:00:37
楼主
