This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


Re: [Xen-devel] [PATCH][ACM] kernel enforcement of vbd policies via blkb

To: Keir Fraser <Keir.Fraser@xxxxxxxxxxxx>
Subject: Re: [Xen-devel] [PATCH][ACM] kernel enforcement of vbd policies via blkback driver
From: Bryan D Payne <bdpayne@xxxxxxxxxx>
Date: Tue, 25 Jul 2006 13:45:52 -0400
Cc: xen-devel@xxxxxxxxxxxxxxxxxxx, Reiner Sailer <sailer@xxxxxxxxxx>
Delivery-date: Tue, 25 Jul 2006 10:46:35 -0700
Envelope-to: www-data@xxxxxxxxxxxxxxxxxx
In-reply-to: <2cc990ff2952dde0f8d12469f9417168@xxxxxxxxxxxx>
List-help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-id: Xen developer discussion <xen-devel.lists.xensource.com>
List-post: <mailto:xen-devel@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
Sender: xen-devel-bounces@xxxxxxxxxxxxxxxxxxx
> The tools hook is not just a usability/conformity check. The check
> ensures that the tools will not set up entries in xenstore that would
> allow blkback to create a non-conformant vbd. So there is no way for a
> guest to trick blkback into creating a non-conformant vbd: it can only
> connect to vbds specified in its config file or added later via the
> vbd-add xm hotplug command. The tools stack should perform its
> compiance checks on both 'xm create' and 'xm vbd-add', and that should
> be sufficient.

My concern is that security is now relying on the correctness of all code
that can write to the xenstore.  The quantity of code that does this will
likely continue to grow, and even include third party tools.  If any of
this code attachs a vbd to a domain without performing a security check,
then the security would be bypassed.

Of course, the situation should be good for now because the xm tools patch
that we recently provided does perform the necessary security checks for
'xm create' and 'xm block-attach'.  However, we will need to continuously
be aware of changes that could bypass these checks.

> You have a point about it being nice to check things at the lowest
> possible level, but I'm not inclined to add extra crud into the device
> drivers for this unless more people scream for it. :-)

Ok, I can certainly understand this viewpoint.  Given your concerns, I
think that it makes sense to not include the patch at this time.  If the
security concerns that I mentioned above turn into reality, we can always
take a second look at this lower-level enforcement.


Xen-devel mailing list

<Prev in Thread] Current Thread [Next in Thread>