Re: severe security issue on dom0/xend/xm/non-root users

[Anthony Liguori <aliguori@us.ibm.com>]

On Fri, 2005-03-04 at 13:19, Rich Persaud wrote:
> Anthony Liguori wrote:
> 
> >Xend is not designed to provide any sort of security protection out of
> >the box.  It assumes that you're running on a trusted network.  Just
> >assume that any person that can ping dom0 has root access to your
> >system.
> >  
> >
> How about the config option that restricts Xend to listening only on the 
> loopback network interface?

That's why I was careful to say "out of the box".

There are a number of things you can do to secure Xend.  You can make it
listen to the loopback device, you could use a firewall (which I think
is a more flexible option).

You can't stop local connections from non-root users but there's not a
whole lot of reason to have non-root users in domain-0 anyway.

BTW, Posix doesn't mandate that filesystem permissions are respected
with unix domain sockets.  Linux currently does check the filesystem
permission bits when opening a unix domain socket.  A few notable Unices
(I think BSD but I'm not sure) don't perform permission checks on domain
sockets.

The proper way to do permission checking with domain sockets is using
SCM data.

Regards,

> Rich
> 
> 
> -------------------------------------------------------
> SF email is sponsored by - The IT Product Guide
> Read honest & candid reviews on hundreds of IT Products from real users.
> Discover which products truly live up to the hype. Start reading now.
> http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
> _______________________________________________
> Xen-devel mailing list
> Xen-devel@lists.sourceforge.net
> https://lists.sourceforge.net/lists/listinfo/xen-devel
-- 
Anthony Liguori
Linux Technology Center (LTC) - IBM Austin
E-mail: aliguori@us.ibm.com
Phone: (512) 838-1208




-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click