From mboxrd@z Thu Jan 1 00:00:00 1970 From: Jonathan Tripathy Subject: Re: RAM security Date: Mon, 06 Dec 2010 15:35:49 +0000 Message-ID: <4CFD02D5.7080903@abpni.co.uk> References: <46C13AA90DB8844DAB79680243857F0F0AFF44@server1.ABPNI.local> <46C13AA90DB8844DAB79680243857F0F0AFF45@server1.ABPNI.local> Mime-Version: 1.0 Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: quoted-printable Return-path: In-Reply-To: List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xensource.com Errors-To: xen-devel-bounces@lists.xensource.com To: George Dunlap , Xen-devel@lists.xensource.com List-Id: xen-devel@lists.xenproject.org Just a few questions: 1) By saying "the guest's responsibility", does this mean that=20 CONFIG_XEN_SCRUB_PAGES=3Dy is set in the DomU kernel config? 2) Also, if a DomU was shutdown by xm destroy, obviously the DomU=20 wouldn=92t scrub the RAM. However would Xen still scrub the RAM? 3) If the physical server was shutdown (e.g. plug pulled), I'm guessing=20 this will presetn a problem? 4) Why doesn't Xen scrub the RAM before giving it to the DomU? Thanks On 06/12/10 14:49, George Dunlap wrote: > I looked into this sometime this last year. I believe the answer is > "no": the domain destruction routines will zero memory before handing > it back to Xen. > > One potential data leak, however (last time I looked at this), is that > Xen does not scrub memory handed back by the balloon driver. So if > the guest OS hasn't scrubbed it, and it contains sensitive > information, it may end up being assigned to another domain as-is > (either via ballooning or start-of-day domain creation). At the > moment that's considered the guest's responsibility. > > -George > > On Mon, Dec 6, 2010 at 2:35 PM, Jonathan Tripathy = wrote: >> Hi Everyone, >> >> In Xen, is a DomU able to access data in RAM which a previous DomU has >> stored in the past, but didn't "zero" it? >> >> I understand that this is a problem with physical disks (using phy:/),= just >> wondering if the same stands with RAM >> >> Thanks >> >> _______________________________________________ >> Xen-devel mailing list >> Xen-devel@lists.xensource.com >> http://lists.xensource.com/xen-devel >> >>