This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


RE: [Xen-devel] severe security issue on dom0/xend/xm/non-root users

To: "Kurt Garloff" <kurt@xxxxxxxxxx>, "Rik van Riel" <riel@xxxxxxxxxx>
Subject: RE: [Xen-devel] severe security issue on dom0/xend/xm/non-root users
From: "Ian Pratt" <m+Ian.Pratt@xxxxxxxxxxxx>
Date: Sun, 13 Mar 2005 17:17:38 -0000
Cc: "Tommi Virtanen" <tv@xxxxxxxxxxxxx>, "Bastian Blank" <waldi@xxxxxxxxxx>, <xen-devel@xxxxxxxxxxxxxxxxxxxxx>, <ian.pratt@xxxxxxxxxxxx>
Delivery-date: Sun, 13 Mar 2005 17:18:01 +0000
Envelope-to: www-data@xxxxxxxxxxxxxxxxxxx
List-archive: <http://sourceforge.net/mailarchive/forum.php?forum=xen-devel>
List-help: <mailto:xen-devel-request@lists.sourceforge.net?subject=help>
List-id: List for Xen developers <xen-devel.lists.sourceforge.net>
List-post: <mailto:xen-devel@lists.sourceforge.net>
List-subscribe: <https://lists.sourceforge.net/lists/listinfo/xen-devel>, <mailto:xen-devel-request@lists.sourceforge.net?subject=subscribe>
List-unsubscribe: <https://lists.sourceforge.net/lists/listinfo/xen-devel>, <mailto:xen-devel-request@lists.sourceforge.net?subject=unsubscribe>
Sender: xen-devel-admin@xxxxxxxxxxxxxxxxxxxxx
Thread-index: AcUn74u8BkE68es0RT+FWPUh5pbVmwAACu6Q
Thread-topic: [Xen-devel] severe security issue on dom0/xend/xm/non-root users
> > On Sun, 13 Mar 2005, Kurt Garloff wrote:
> > > Why not just require the other end of the socket to be below 1024?
> > > If you bind to localhost, that should be enough.
> > 
> > Because the ability to open connections from ports < 1024
> > is a capability, which can be retained by daemons after
> > dropping the other root privileges.

I think this is a good first step, and pretty easy to implement.

With the next generation of tools we could insist on using SSL and thus
that the client have an appropriate certificate.


SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
Xen-devel mailing list