This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


Re: [Xen-users] Re: malicious paravirtualized guests: security and isola

To: xen-users@xxxxxxxxxxxxxxxxxxx
Subject: Re: [Xen-users] Re: malicious paravirtualized guests: security and isolation
From: "Vasiliy Baranov" <vasiliy.baranov@xxxxxxxxx>
Date: Tue, 11 Nov 2008 20:03:55 +0300
Delivery-date: Tue, 11 Nov 2008 09:04:40 -0800
Dkim-signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:received:message-id:date:from:to :subject:in-reply-to:mime-version:content-type:references; bh=y/p+gQ/Xp5chjNRGtxo7BfHCVh0g8HYvsj1oIBc7tyk=; b=axztV7122q8T4AxugaIlS4VitF3UvYlE+NtEhHTj4UPjIWSu/LgXjUyyPgZcyxP+bx apyja8C9zQ7qvC2vLYuuPUR9mMx6FnXEaIVmNHlMhd8jWymcvP1R7k42PrliggV6rlnK GFbrrLP5maEREPBY99bsHvdXJ7i0uOgQo0Gas=
Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:in-reply-to:mime-version :content-type:references; b=mFce1eDjl9Btj9vr1KlaGKltBvMXusconXpsgCe62y1Vig0LJ8TcuEdUkT02x9/Lbr KPyziRIOt4fyd1Cg22qsEyk455Isr8HphMNwEBomnuwm9n09ik9F7pkIs9jpCAV7nEAn /iwqDSHBVqnU1BOrvEKscUreIEwqt2PzgtLFo=
Envelope-to: www-data@xxxxxxxxxxxxxxxxxxx
In-reply-to: <1e16a9ed0811110652t2eb151e7r2aacd9c6c9be01d7@xxxxxxxxxxxxxx>
List-help: <mailto:xen-users-request@lists.xensource.com?subject=help>
List-id: Xen user discussion <xen-users.lists.xensource.com>
List-post: <mailto:xen-users@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/mailman/listinfo/xen-users>, <mailto:xen-users-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/mailman/listinfo/xen-users>, <mailto:xen-users-request@lists.xensource.com?subject=unsubscribe>
References: <e4a2b0250811060515y6a898342u372768672e7365a@xxxxxxxxxxxxxx> <e4a2b0250811110635sfd631f8j34bde29d442a436c@xxxxxxxxxxxxxx> <1e16a9ed0811110652t2eb151e7r2aacd9c6c9be01d7@xxxxxxxxxxxxxx>
Sender: xen-users-bounces@xxxxxxxxxxxxxxxxxxx

On Tue, Nov 11, 2008 at 5:52 PM, Todd Deshane <deshantm@xxxxxxxxx> wrote:
On Tue, Nov 11, 2008 at 9:35 AM, Vasiliy Baranov
>> I have a question about isolation and security guarantees Xen provides, if any, in cases when domU >> guests are not completely trusted, that is, can be malicious. Right now I am specifically interested in >> the scenario where all guests are paravirtualized, but HVM case is of some interest too.

>> Say, I want to let my users run their own guests on a Xen host that I own. Users will bring their own >> disk images. I don't completely trust my users. Does the use of Xen guarantees that malicious
>> guests will be unable to harm other guests or the entire host in any way (for example, kill the entire >> host)? It is interesting to know both what is guaranteed in theory (that is, if Xen and dom0 work as >>  designed) and how things go in practice.

>> If I disallow users to use their kernels, that is, if I run guests with my own kernel(s) only, will that
>> improve the situation? How about loadable kernel modules? If I allow Linux guests to load their
>> custom kernel modules, will that nullify the effect of using trusted kernels?

>> I currently use Xen 3.1.4, if that matters.

> Am I asking stupid questions or is this area a complete mystery? Any
> pointers to existing sources of information are greatly appreciated. I spent
> several days searching Xen documentation and googling but could not find
> anything definitive.

I think it is a good question. Have you spent any time searching through the
xen mailing lists, in particular xen-devel might have some information. A good
way to search is using xen.markmail.org.

First of all, thank you for replying, Yes, I searched these lists. I'll try once more.

The xen developers (xen-devel) might also have some more insight for you.

OK, I'll try.

There are probably some users out there in your situation, but the conventional
wisdom is that isolation and the security of it is very similar to
that of computers
on a network.

Is a side note, perhaps I was not clear but the question is not about network security. It is about the safety of the domU <-> hypervisor interface and the safety of running guests on the same hardware as the hypervisor, from the point of view of protection from untrusted guests.

White hat hackers have been able to find various tricky ways to break out of
the isolation that xen provides, but I haven't heard of any exploits that have
been taken advantage of in practice.

Hope that helps.


Thanks again,
Xen-users mailing list
<Prev in Thread] Current Thread [Next in Thread>