From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:60730) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RYGMJ-0005YG-QH for qemu-devel@nongnu.org; Wed, 07 Dec 2011 07:12:24 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1RYGMI-0005cn-DW for qemu-devel@nongnu.org; Wed, 07 Dec 2011 07:12:23 -0500 Received: from mx1.redhat.com ([209.132.183.28]:63014) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RYGMI-0005cC-1p for qemu-devel@nongnu.org; Wed, 07 Dec 2011 07:12:22 -0500 Message-ID: <4EDF5821.8080302@redhat.com> Date: Wed, 07 Dec 2011 14:12:17 +0200 From: Dor Laor MIME-Version: 1.0 References: <1323230623-8709-1-git-send-email-mdroth@linux.vnet.ibm.com> <4EDF4119.5090300@redhat.com> <20111207105232.GF9888@redhat.com> In-Reply-To: <20111207105232.GF9888@redhat.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH 1/2] guest agent: add RPC blacklist command-line option Reply-To: dlaor@redhat.com List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: "Daniel P. Berrange" Cc: aliguori@us.ibm.com, Michael Roth , qemu-devel@nongnu.org On 12/07/2011 12:52 PM, Daniel P. Berrange wrote: > On Wed, Dec 07, 2011 at 12:34:01PM +0200, Dor Laor wrote: >> On 12/07/2011 06:03 AM, Michael Roth wrote: >>> This adds a command-line option, -b/--blacklist, that accepts a >>> comma-seperated list of RPCs to disable, or prints a list of >>> available RPCs if passed "?". >>> >>> In consequence this also adds general blacklisting and RPC listing >>> facilities to the new QMP dispatch/registry facilities, should the >>> QMP monitor ever have a need for such a thing. >> >> Beyond run time disablement, how easy it is to compile out some of >> the general commands such as exec/file-handling? >> >> Security certifications like common criteria usually ask to compile >> out anything that might tamper security. > > I don't think that's really relevant/needed. As discussed on the > call yesterday, this is security theatre, because nothing can prevent > the host admin from accessing guest RAM or disk data. AFAIK the > virtualization related security certifications acknowledge this > already& don't make any claims about security of guests against > a malicious host admin. In any case, a suitable SELinux policy for > the guest agent could prevent arbitrary file/binary access via > generic 'exec' / 'file-read' commands, in a manner that is sufficient > to satisfy security certications. I absolutely agree that the hypervisor can tweak the guest in multiple ways. Nevertheless there are two reasons I asked it: 1. Reduce code and noise from security reviewers eyes. We were asked to do exactly that for other qemu functionality that is included but does not run at all. It's just makes the review faster. 2. Every piece of code is a risk for exploit Imagine that a bug/leak/use-after-free in the blacklist command or the exec command on qemu exists and allows attacked to gain control of qemu. > > Regards, > Daniel