* I/O port access permission
@ 2006-08-01 15:02 Jan Beulich
2006-08-01 15:37 ` Keir Fraser
0 siblings, 1 reply; 2+ messages in thread
From: Jan Beulich @ 2006-08-01 15:02 UTC (permalink / raw)
To: xen-devel
Isn't it inconsistent (and perhaps to be considered a security hole)
that construct_dom0() specifically revokes access for a small group of
ports, but DOM0_IOPORT_PERMISSION blindly grants access to any ports
(including the 'special' ones) and any domain?
Thanks, Jan
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: I/O port access permission
2006-08-01 15:02 I/O port access permission Jan Beulich
@ 2006-08-01 15:37 ` Keir Fraser
0 siblings, 0 replies; 2+ messages in thread
From: Keir Fraser @ 2006-08-01 15:37 UTC (permalink / raw)
To: Jan Beulich; +Cc: xen-devel
On 1 Aug 2006, at 16:02, Jan Beulich wrote:
> Isn't it inconsistent (and perhaps to be considered a security hole)
> that construct_dom0() specifically revokes access for a small group of
> ports, but DOM0_IOPORT_PERMISSION blindly grants access to any ports
> (including the 'special' ones) and any domain?
>
> Thanks, Jan
The intention was sane start-of-day settings, not absolute security. We
could add an 'absolutely no access' rangeset but it's not clear it's
worth it.
-- Keir
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2006-08-01 15:37 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2006-08-01 15:02 I/O port access permission Jan Beulich
2006-08-01 15:37 ` Keir Fraser
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.