Re: [Xen-users] Vserver like security in Xen

[Mark Williamson <mark.williamson@xxxxxxxxxxxx>]

> I have been using Xen and vserver for some time now.  One feature I would
> like to reproduce in Xen is Vservers ability to limit/reduce root's
> privileges using the Linux (POSIX) Capability system.

I'm familiar with Xen rather than VServer.  Xen doesn't really do anything to 
lock down what root can do within the virtual machine.  The way you'd lock 
things down is to impose restrictions on what that machine could do, e.g. 
checks on IP addresses, firewalling to only allow certain protocols through, 
etc etc.

There's currently not a lot you can do to prevent root eg. modifying 
filesystems, although you could arrange some sort of backups / snapshots or 
even network-based logging so that there is some sort of unforgeable audit 
trail.

Any particular things you had in mind?

Cheers,
Mark

> I would appreciate any comments from those who are familiar with both
> Vserver and Xen and have been able to lock down root's abilities and
> privileges.
>
>
> Thanks!
> --Jim
>
>
> _______________________________________________
> Xen-users mailing list
> Xen-users@xxxxxxxxxxxxxxxxxxx
> http://lists.xensource.com/xen-users

-- 
Dave: Just a question. What use is a unicyle with no seat?  And no pedals!
Mark: To answer a question with a question: What use is a skateboard?
Dave: Skateboards have wheels.
Mark: My wheel has a wheel!

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users