Re: [Xen-devel] Enabling domU to create other domUs

["Hayawardh V" <hayawardh@xxxxxxxxx>]

On Wed, Jul 9, 2008 at 8:38 AM, Ian Jackson <Ian.Jackson@xxxxxxxxxxxxx> wrote:

Cihula, Joseph writes ("RE: [Xen-devel] Enabling domU to create other domUs"):

> If you're up for doing some work, I'd recommend that approach as it will
> not only solve your problem but also bring the community a step closer
> to a de-privileged dom0.

I agree with this (although the original enquirer may find that this
is not necessarily the most expedient path to solving their problem).

Thanks all for the suggestions. I am envisioning a system where each domain has the capability to create/destroy any domain and perform any task. In effect, all domains should have the power of the current-day dom0. The XSM policy should control which domain can do what. Isn't this the most general approach?

If the capability of domain creation is separated into a domB, still only domB will be capable of creating a domain.
(Of course, if all domains have full power, then the size of the TCB will depend on the properties of the policy).

I would not recommend using the Xen Security Modules arrangements.
There are quite a few bugs in this code, including some very serious
security bugs (which sadly we aren't allowed to give more information
about as the reports were embargoed).

Unfortunately turning on the XSM support is likely to result in a
substantially less secure system.

I agree that XSM today may be insufficient, but I am not going to use it in a production system, and hopefully it will mature in the future.

Hayawardh

Ian.

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel