Re: severe security issue on dom0/xend/xm/non-root users

[Nicholas Lee <nic-lists@plumtree.co.nz>]

On Fri, Mar 04, 2005 at 01:54:02PM -0600, Anthony Liguori wrote:
> I'm not saying it's a non-issue :-)  It's one of the reasons I'm working
> on VM-Tools.  Security is not something you can just retro-fit into
> something.  It has to be designed in from the beginning.

How stable is VM-Tools for a purely single computer Xen system? No
migration features. Just startup and shutdown of domUs. ie. As a
replacement for UML.


> That said, I don't think Xend not being secure on a hostile dom0 is a
> bug per-say.  Really, having a hostile dom0 is putting an awful lot of
> faith in the Linux syscall interface.

If someone has privileged access to block devices, then there really
isn't much you can do.

However, doesn't mean that you can't work hard to make it difficult to
abuse. Security after all is a layer approach. The more you do at each
level, the less options an attacker has.

However, delegating all network security to iptables is a bad idea IMO.
Leaves you open for when iptables breaks.


Is it possible to turn off the migration features of xend completely?
ie. remove the need for the network layer.

Nicholas



-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click