This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


Re: [Xen-devel] severe security issue on dom0/xend/xm/non-root users

To: Tommi Virtanen <tv@xxxxxxxxxxxxx>
Subject: Re: [Xen-devel] severe security issue on dom0/xend/xm/non-root users
From: Kurt Garloff <garloff@xxxxxxx>
Date: Fri, 18 Mar 2005 10:31:58 +0100
Cc: Xen development list <xen-devel@xxxxxxxxxxxxxxxxxxxxx>, Philip R Auld <pauld@xxxxxxxxxxx>, David Hopwood <david.hopwood@xxxxxxxxxxxxxxxx>
Delivery-date: Fri, 18 Mar 2005 09:33:14 +0000
Envelope-to: www-data@xxxxxxxxxxxxxxxxxxx
In-reply-to: <423A9D38.9080601@xxxxxxxxxxxxx>
List-archive: <http://sourceforge.net/mailarchive/forum.php?forum=xen-devel>
List-help: <mailto:xen-devel-request@lists.sourceforge.net?subject=help>
List-id: List for Xen developers <xen-devel.lists.sourceforge.net>
List-post: <mailto:xen-devel@lists.sourceforge.net>
List-subscribe: <https://lists.sourceforge.net/lists/listinfo/xen-devel>, <mailto:xen-devel-request@lists.sourceforge.net?subject=subscribe>
List-unsubscribe: <https://lists.sourceforge.net/lists/listinfo/xen-devel>, <mailto:xen-devel-request@lists.sourceforge.net?subject=unsubscribe>
Organization: SUSE/Novell
References: <20050313145512.GC29310@xxxxxxxxxxxxxxxxx> <4234B2F5.1070205@xxxxxxxxxxxxxxxx> <20050313215122.GC11358@xxxxxxxxxxxxxxxxx> <20050314145850.GB6037@xxxxxxxxxxxxxxxxxx> <20050314151652.GE11417@xxxxxxxxxxxxxxxxx> <20050314155421.GD6037@xxxxxxxxxxxxxxxxxx> <20050314161316.GM11417@xxxxxxxxxxxxxxxxx> <423927DB.3040305@xxxxxxxxxxxxx> <20050317150230.GW11685@xxxxxxxxxxxxxxxxx> <423A9D38.9080601@xxxxxxxxxxxxx>
Sender: xen-devel-admin@xxxxxxxxxxxxxxxxxxxxx
User-agent: Mutt/1.5.6i

On Fri, Mar 18, 2005 at 11:19:52AM +0200, Tommi Virtanen wrote:
> Oh, the group-restricted UNIX domain socket wins there, too.

I'm not convinced.

> Your model:
>   - setuid client that only lets certain users open ports <1024

You're very flexible in your setuid root client.

1. You may restrict the set of users that is able to call the client,
   e.g. it might be root:trusted 4750. This would impose the same 
   restrictions as your group protection mechanism. 
2. The first thing the client does it to acquire the privileged 
   port and then drop capabilities immediately afterwards. Security
   flaws in the client will thus at most grant the exploiter a
   privileged socket. (This has nothing to do with xen, just a
   general rule for setuid root apps.)
3. The client can impose whatever restrictions it likes, e.g.
   checking SSL certificates, asking for passwords, checking
   a configuration file, whatever.

> The UNIX domain socket way is both more flexible and _more secure_
> -- it only needs setgid where the port<1024 thing needs setuid.

I don't see a big difference in neither flexibility nor security.
So let's create patches and see which one looks better in the end :-)

Kurt Garloff                   <kurt@xxxxxxxxxx>             [Koeln, DE]
Physics:Plasma modeling <garloff@xxxxxxxxxxxxxxxxxxx> [TU Eindhoven, NL]
Linux: SUSE Labs (Director)    <garloff@xxxxxxx>            [Novell Inc]

Attachment: pgpMGWKwm6qyo.pgp
Description: PGP signature

<Prev in Thread] Current Thread [Next in Thread>