From mboxrd@z Thu Jan 1 00:00:00 1970 From: Luke Kenneth Casson Leighton Subject: Re: protecting xen startup Date: Wed, 24 Nov 2004 10:53:00 +0000 Message-ID: <20041124105300.GN5146@lkcl.net> References: <39CC97884CA19A4D8D6296FE94357BCBF5C747@swsmsx404> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Return-path: Content-Disposition: inline In-Reply-To: <39CC97884CA19A4D8D6296FE94357BCBF5C747@swsmsx404> Sender: xen-devel-admin@lists.sourceforge.net Errors-To: xen-devel-admin@lists.sourceforge.net List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , List-Archive: To: "Neugebauer, Rolf" Cc: Mark Williamson , xen-devel@lists.sourceforge.net List-Id: xen-devel@lists.xenproject.org On Tue, Nov 23, 2004 at 11:58:51PM -0000, Neugebauer, Rolf wrote: > From a security point of view we probably should/need to restructure the > current xend significantly into at least two components: a small name > server and a daemon/tool which knows about assignment of higher level > devices to domains etc. Note that this will also require changes to > backend and frontends etc, ie, it's non-trivial. hi rolf, i'm not familiar enough with the terminology that you are using to understand fully what you are saying. are you hinting at the allocation of device drivers across domains? e.g. having one domain do the hardware side and securely proxy-forwarding the access to that device over to another domain? for example /dev/console in one domain being proxy-forwarded into another domain for it to be accessible as /dev/xendomainconsole0, something like that? because if so that _would_ be great because it'd be a trivial job in selinux to set up an selinux permission to access the device inode at the "receiving" end so to speak. ... but i have to point out that i'm more concerned about leveraging what is available - right now - than i am about future versions. l. ------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://productguide.itmanagersjournal.com/