WARNING - OLD ARCHIVES

This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
   
 
 
Xen 
 
Home Products Support Community News
 
   
 

xen-devel

Re: [Xen-devel] severe security issue on dom0/xend/xm/non-root users

To: Philip R Auld <pauld@xxxxxxxxxxx>
Subject: Re: [Xen-devel] severe security issue on dom0/xend/xm/non-root users
From: Kurt Garloff <kurt@xxxxxxxxxx>
Date: Mon, 14 Mar 2005 17:13:16 +0100
Cc: David Hopwood <david.hopwood@xxxxxxxxxxxxxxxx>, xen-devel@xxxxxxxxxxxxxxxxxxxxx
Delivery-date: Mon, 14 Mar 2005 16:14:57 +0000
Envelope-to: www-data@xxxxxxxxxxxxxxxxxxx
In-reply-to: <20050314155421.GD6037@xxxxxxxxxxxxxxxxxx>
List-archive: <http://sourceforge.net/mailarchive/forum.php?forum=xen-devel>
List-help: <mailto:xen-devel-request@lists.sourceforge.net?subject=help>
List-id: List for Xen developers <xen-devel.lists.sourceforge.net>
List-post: <mailto:xen-devel@lists.sourceforge.net>
List-subscribe: <https://lists.sourceforge.net/lists/listinfo/xen-devel>, <mailto:xen-devel-request@lists.sourceforge.net?subject=subscribe>
List-unsubscribe: <https://lists.sourceforge.net/lists/listinfo/xen-devel>, <mailto:xen-devel-request@lists.sourceforge.net?subject=unsubscribe>
Organization: SUSE/Novell
References: <20050304195646.GA31213@xxxxxxxxxxxxxxxxxxxxxxx> <Pine.LNX.4.61.0503051651070.31720@xxxxxxxxxxxxxxxxxxxxxxxxxxx> <422B1E47.9050502@xxxxxxxxxxxxx> <Pine.LNX.4.61.0503061613160.31720@xxxxxxxxxxxxxxxxxxxxxxxxxxx> <20050313145512.GC29310@xxxxxxxxxxxxxxxxx> <4234B2F5.1070205@xxxxxxxxxxxxxxxx> <20050313215122.GC11358@xxxxxxxxxxxxxxxxx> <20050314145850.GB6037@xxxxxxxxxxxxxxxxxx> <20050314151652.GE11417@xxxxxxxxxxxxxxxxx> <20050314155421.GD6037@xxxxxxxxxxxxxxxxxx>
Sender: xen-devel-admin@xxxxxxxxxxxxxxxxxxxxx
User-agent: Mutt/1.5.6i
On Mon, Mar 14, 2005 at 10:54:21AM -0500, Philip R Auld wrote:
> Rumor has it that on Mon, Mar 14, 2005 at 04:16:52PM +0100 Kurt Garloff said:
> > The most straightforward approach would be to have dom0 sysadmin to be
> > the one in control of all the other domains.
> 
> That's not really ideal for a virtualized environment. Think of a hosting
> setup for example. You'd really like to have the "hoster" control dom0, but
> have roles that allow a vm sysadmin to control his domain. Console and 
> power/reset only perhaps, but still some xend access.

Agreed.

> > Of course, the other domains can have their own root users. This is
> > not changed by restricting control connections to be originating from
> > ports < 1024.
> 
> I'm not arguing against that. I was just pointing out the difference in 
> roles needed. I think that will actually be orthagonal to protecting
> xend itself. Make it secure first then carefully allow access for roles.
> The tools will need to handle this permission I think. 

I agree.

Currently xend just accepts every command that it receives.
Not a good basis to grant role based permissions ...

So, we need to have some restrictions first, so tools can
grant them for the right people.

And my suggestion was binding to localhost only and requiring a port 
< 1024 -- then you'd need to be a local user with CAP_NET_BIND_SERVICE 
capability.  Granting additional rights by providing this capability 
from a setuid root wrapper (or a PAM service that sets this on login)
should not be too hard and straightforward enough to not introduce
another load of security holes.

The disadvantage of this is that it's a all or nothing approach.
xend could be made more clever and require the user to show
different certificates for different operations on different
domains. But this is no short term solution.

It would give a rather large matrix of certificates, one dimension
being the kind of operation (list, restart, sysrq, balloon, scheduler,
save/restrore, migrate, ...), another one being the domain. We could
have master certificates for both directions, of course.


Regards,
-- 
Kurt Garloff                   <kurt@xxxxxxxxxx>             [Koeln, DE]
Physics:Plasma modeling <garloff@xxxxxxxxxxxxxxxxxxx> [TU Eindhoven, NL]
Linux: SUSE Labs (Director)    <garloff@xxxxxxx>            [Novell Inc]

Attachment: pgp4SKoMQJQ8U.pgp
Description: PGP signature

<Prev in Thread] Current Thread [Next in Thread>