Nivedita Singhvi wrote:
Anthony Liguori wrote:
Ok, I confirmed this, out of the box, accessing
http://localhost:8000/xen/domain as a lesser-privileged user allows
one to do very bad things.
Anthony, were you using the default xend-config.sxp?
Yup.
Currently, although the default is off for http support
in xend, the default config file turns it on:
#(xend-http-server no)
(xend-http-server yes)
Yup. This was added in:
# HG changeset patch
# User emellor@xxxxxxxxxxxxxxxxxxxxxx
# Node ID cefe36be8592090b4edb08060cca67a004c04617
# Parent 4d49f61a7feef3fca5fb3e991a5a1d741b6cd690
Tidy xend-config.sxp, removing entries that haven't been used since the
hotplugging stuff was introduced (block-*, console-port-base,
console-address)
and introducing entries for options that have been present for ages
(xend-{http,unix,relocation}-server, xend-unix-path,
xend-relocation-address,
enable-dump). Remove vif-antispoof, as Vifctl no longer passes this option
down.
I imagine it was unintentional. Ewan?
Regards,
Anthony Liguori
thanks,
Nivedita
Regards,
Anthony Liguori
Anthony Liguori wrote:
Hi,
On IRC, it came up that recent snapshots of Xend are now listening
for TCP HTTP connections again by default. Since it's still
listening on a Unix socket and xm will always prefer that, xm still
only functions as root.
However, less privileged users can still connect to the TCP port and
through Xend gain root access. This seems like a pretty bad default
configuration. I poked around on the TCP interface but couldn't
seem to confirm this (does it only accept s-expression Content-Type
now?).
Thanks for any clarification on this.
Regards,
Anthony Liguori
_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel
_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel
_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel
|
Home