All of lore.kernel.org
 help / color / mirror / Atom feed
From: Anthony Liguori <anthony@codemonkey.ws>
To: Carl-Daniel Hailfinger <c-d.hailfinger.devel.2006@gmx.net>
Cc: qemu-devel@nongnu.org, Ian Jackson <Ian.Jackson@eu.citrix.com>,
	Avi Kivity <avi@redhat.com>,
	Alexandre Bique <bique.alexandre@gmail.com>,
	Paul Brook <paul@codesourcery.com>
Subject: Re: [Qemu-devel] [PATCH 0/5] ATAPI pass through v2
Date: Wed, 08 Jul 2009 13:03:03 -0500	[thread overview]
Message-ID: <4A54DF57.6080303@codemonkey.ws> (raw)
In-Reply-To: <4A54D722.3040602@gmx.net>

Carl-Daniel Hailfinger wrote:
> On 08.07.2009 18:38, Avi Kivity wrote:
>   
>> On 07/08/2009 07:09 PM, Ian Jackson wrote:
>>     
>>>> I'm sure something like SELinux can be used to prevent a root QEMU
>>>> process from doing a firmware upgrade.
>>>>      
>>>>         
>>> *boggle*  You're not serious, are you ?    
>>>       
>> selinux can prevent anything.  In fact, I'm sure it does.
>>     
>
> I doubt SELinux has a builtin ATAPI command filter which knows all
> _undocumented_ firmware upgrade commands. In fact, there are some ATAPI
> devices which abuse existing and documented-as-harmless ATAPI commands
> (which are regularly used for CD burning) for firmware upgrades.
>   

So then we can't prevent it either which means the whole discussion is 
moot :-)

Regards,

Anthony Liguori

  reply	other threads:[~2009-07-08 18:03 UTC|newest]

Thread overview: 16+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2009-07-01 18:31 [Qemu-devel] [PATCH 0/5] ATAPI pass through v2 Bique Alexandre
2009-07-07 20:03 ` Stuart Brady
2009-07-07 21:21   ` Alexandre Bique
2009-07-07 22:44     ` Paul Brook
2009-07-07 22:50       ` Alexandre Bique
2009-07-07 23:01         ` Anthony Liguori
2009-07-07 23:15           ` Stuart Brady
2009-07-08 16:09           ` Ian Jackson
2009-07-08 16:38             ` Avi Kivity
2009-07-08 17:28               ` Carl-Daniel Hailfinger
2009-07-08 18:03                 ` Anthony Liguori [this message]
2009-07-08 18:09                 ` Avi Kivity
2009-07-08 17:20             ` Anthony Liguori
2009-07-08 17:48               ` Vincent Hanquez
2009-07-08 18:06                 ` Anthony Liguori
2009-07-07 22:58   ` Anthony Liguori

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=4A54DF57.6080303@codemonkey.ws \
    --to=anthony@codemonkey.ws \
    --cc=Ian.Jackson@eu.citrix.com \
    --cc=avi@redhat.com \
    --cc=bique.alexandre@gmail.com \
    --cc=c-d.hailfinger.devel.2006@gmx.net \
    --cc=paul@codesourcery.com \
    --cc=qemu-devel@nongnu.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.