This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


[Xen-devel] severe security issue on dom0/xend/xm/non-root users

To: xen-devel@xxxxxxxxxxxxxxxxxxxxx
Subject: [Xen-devel] severe security issue on dom0/xend/xm/non-root users
From: Adam Heath <doogie@xxxxxxxxxxxxx>
Date: Fri, 4 Mar 2005 11:23:05 -0600 (CST)
Cc: Bastian Blank <waldi@xxxxxxxxxx>
Delivery-date: Fri, 04 Mar 2005 17:27:37 +0000
Envelope-to: xen+James.Bulpin@xxxxxxxxxxxx
List-archive: <http://sourceforge.net/mailarchive/forum.php?forum=xen-devel>
List-help: <mailto:xen-devel-request@lists.sourceforge.net?subject=help>
List-id: List for Xen developers <xen-devel.lists.sourceforge.net>
List-post: <mailto:xen-devel@lists.sourceforge.net>
List-subscribe: <https://lists.sourceforge.net/lists/listinfo/xen-devel>, <mailto:xen-devel-request@lists.sourceforge.net?subject=subscribe>
List-unsubscribe: <https://lists.sourceforge.net/lists/listinfo/xen-devel>, <mailto:xen-devel-request@lists.sourceforge.net?subject=unsubscribe>
Sender: xen-devel-admin@xxxxxxxxxxxxxxxxxxxxx
Bastian informed me on irc of a very severe security problem with xen.  A
normal user can run xm, which then just communicates using tcp to xend, to do
the work.  This allows a normal user to create domains, which then allows a
normal user to be able to access block devices.

Doing chmod 700 on the xm binary won't help, as the user could just copy the

My suggestion is to have an auth file of some kind in /etc/xen, chmod 700,
that both xend and xm can then read.  They'd then have to use https to
communicate.  But that's only if you stick with python.

Unix domain sockets don't have this problem, as they can query the userid at
the other end of the socket.

SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
Xen-devel mailing list