Reflex Systems announced today that they have the first VMware VMsafe Certification for their Reflex VMC product. This announcement brings two things to light. The first is that VMware has made a very smart move to certify VMsafe drivers for their hypervisor, which is a much needed step I have written about previously. The second is that Reflex Systems has been working through the process with VMware and working out the bugs in the process as well. This will help other vendors and VMware. Kudos to Reflex Systems!
But what does being VMsafe Certfied imply?At the very least such certification implies that VMware has tested the product within VMware vSphere 4. It furthermore implies that VMware has blessed the code as not interfering with other components of the standard VMware vSphere 4 installation. However, what is standard could be up for debate.
It also implies that VMware has performed code signing so that you know when you download the VMsafe component of Reflex VMC, that it is a legitimate VMsafe driver and will load seemlessly into the VMware hypervisor kernel.
However, my questions about the certification follow:
- Were the drivers tested with all permutations (licensing types and features) of the vmkernel or is it tested only at specific licensing levels and features?
- Were Code Reviews performed for common security and kernel issues? How exhuastive is such a review? What is the criteria for such a code review?
- Were the drivers tested with other VMsafe driver modules from within VMware and other third parties?
- Were the drivers tested under low, medium, and heavy memory, cpu, disk, and network load as well as combinations of these loads?
- How is the code signed once it is certified? Whose signature should we see?
I ask these questions, because if we do not know the standard to which the certification was held, how can we judge whether it is safe to use within our environments? If for example some one mentioned that the code adheres to CC EAL4+ we know exactly where to go to find information for this level of the Common Criteria. We should also be able to go to such a place within the VMware website to get the same information for their Certification. All I have from VMware is that the process is stringent. Yet that word can mean different things to different people. So we really need to know the particulars.
The other reason I ask this, is that if the VMsafe Certification only tests the drivers using VMware vSphere 4 Enterprise Plus level without MPP, Nexus 1000V, or DRS enabled, then the use of this driver will not be certified if MPP, Nexus 1000V, DRS, or other license levels are used instead.
Even so, this is a very good first step for VMware and congratulations should be given to Reflex Systems on being the first through the process. Kudos!
Comments are closed.