From: Blaisorblade <blaisorblade@yahoo.it>
To: user-mode-linux-devel@lists.sourceforge.net
Cc: Nuutti Kotivuori <naked@iki.fi>
Subject: Re: [uml-devel] Re: uml_switch security fixing
Date: Wed, 9 Mar 2005 10:23:50 +0100 [thread overview]
Message-ID: <200503091023.50460.blaisorblade@yahoo.it> (raw)
In-Reply-To: <87hdjs6gmn.fsf@aka.i.naked.iki.fi>
On Thursday 03 March 2005 13:47, Nuutti Kotivuori wrote:
> blaisorblade@yahoo.it wrote:
> > Suggestions?
>
> FWIW, we have gone off using switch daemon entirely. We are using
> simply preallocated tap devices, connected to bridges via normal Linux
> bridging controls. Works cleaner and faster, more places to dump the
> traffic from and it allows normal linux traffic queueing and
> firewalling to be used to limit transfers between machines.
>
> All physical networks and virtual network (networks not connected to
> any physical interfaces) are implemented as bridges.
>
> The only problem was the tap device queue hang (SIGIO problem), which
> was resolved with the one queue option (and hopefully fixed in UML or
> mainline kernel later).
I just verified I was inaccurate in the title... the problem which was found
was about the setuid uml_net, not uml_switch. It amounts to the possibility
for unprivileged users to do the equivalent of "ifconfig down " for chosen
interfaces, by simply running uml_net.
--
Paolo Giarrusso, aka Blaisorblade
Linux registered user n. 292729
http://www.user-mode-linux.org/~blaisorblade
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
User-mode-linux-devel mailing list
User-mode-linux-devel@lists.sourceforge.net
https://lists.sourceforge.net/lists/listinfo/user-mode-linux-devel
next prev parent reply other threads:[~2005-03-09 16:04 UTC|newest]
Thread overview: 8+ messages / expand[flat|nested] mbox.gz Atom feed top
2005-03-02 14:53 [uml-devel] uml_switch security fixing Blaisorblade
2005-03-03 12:47 ` [uml-devel] " Nuutti Kotivuori
2005-03-09 9:23 ` Blaisorblade [this message]
-- strict thread matches above, loose matches on Subject: below --
2005-03-07 4:42 [uml-devel] " Steve Schmidtke
2005-03-09 10:34 ` Blaisorblade
2005-03-09 18:53 ` Steve Schmidtke
2005-03-09 19:31 ` Blaisorblade
2005-03-12 5:48 ` Jeff Dike
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=200503091023.50460.blaisorblade@yahoo.it \
--to=blaisorblade@yahoo.it \
--cc=naked@iki.fi \
--cc=user-mode-linux-devel@lists.sourceforge.net \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox