I have read that each android applications runs on a different Dalvik VM process (all forked from zygote).
I also read that these VMs are really lightweight and use copy on write buffers and all that, so far so good.
But, I also read that this was not done for security reasons (e.g. isolation) - in fact dalvik vm should not be considered a security boundary, says Google.
So my question is this: Why each process has to run on a different VM?
In Android, every application runs as a separate user. In the Linux kernel, each process is owned by a single user, therefore it is not possible to run multiple Dalvik applications on a single Linux process.
The overhead of running multiple Dalvik VM instance is lightweight because Linux fork() system call is copy-on-write, a write to a shared COW page will cause a "page fault" and that page will be copied; so even though most of the VM's memory region in the RAM is shared there are no "shared state" between VMs.
Forking processes provides only state isolation, but not privilege isolation.
dalvik vm should not be considered a security boundary
That is because the VM cannot enforce a security boundary. The VM is running on user mode (the same mode as the program it's executing), which means a bug in the VM might allow the application to modify VM state in a way that is not intended; the kernel, however, runs in privileged mode and can enforce security boundary.
Each Dalvikvm process runs under a sand-boxed environment owned by the user id (uid) of the application running, it should be noted that upon installation of the application, the uid is allocated and assigned to each installed application.
The net result is that each running application cannot trample another's process due to the different uid assigned, that grants the protection for the running apps.
Another way of looking at it is this - had there being one common uid for all applications, then a malicious application can really cause havoc, be peering into one's settings, override, intercept another application's running code and do all sorts of bad thingsTM to that application.
The Dalvik VM isn't providing a security boundary, but the kernel is providing a security boundary in terms of the process the VM runs in. That's why, for example, it is no big deal for an Android application to run native code, which (more or less) by definition runs outside the VM. It's still in the process, and the kernel ensures that the process isn't going to be able to harm other applications, whether the process is running code within the VM or not.
