[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Xen-devel] [patch 5/5] xen: net features

On Tue, Feb 01, 2005 at 12:00:17AM -0000, Ian Pratt wrote:
> > > I can't see why making the frontend MAC readonly can really be done
> > > securely within the domain.
> > 
> > Well, if you have module support enabled in the kernel, or some way
> > that lets root write to random (domain) memory, then it's not really
> > secure, although i think it's still a nice to have. Otherwise i would
> > think it should be reasonably secure?
> You need root access to change the mac normally, and its trivial for
> root to change it under your scheme -- running sed on /dev/mem would do
> it...

I was thinking of something along the lines of adding a tiny bit of code
to remove the CAP_SYS_MODULE and CAP_SYS_RAWIO capabilities from the global
set of allowed cap's when using the readonly option. With that in place you're
down to requiring a kernel-hole to get around it.

> > > > (2) the addition of some xen-specific sysfs attributes
> > > > on front/back vifs, 
> > > 
> > > What attributes?
> > 
> > Backend:
> > - xen/fe.domain: frontend domain name
> > - xen/fe.initial_address: initial frontend interface mac address
> > - xen/fe.mac_mode: mac mode of the frontend interface (r/w)
> > - xen/be.mac_mode: mac mode of the backend interface (r/w)
> > 
> > Frontend:
> > - xen/mac_mode: mac mode of the interface
> What's the naming convention for multiple fe/bs's.

Ah, sorry. I've had my head stuck in the sysfs system so much lately
I didn't get enough context. Network interfaces appear within sysfs as:


so, eg, /sys/class/net/vif1.0. The paths above are located within that,
so you'd have /sys/class/net/vif1.0/xen/fe.initial_address

> I can see some point having the be enforce the MAC, and possibly in
> having the enforcement address being configurable via sysfs. I'm not a
> big fan of this section of the patch, though.

The entire idea of it or just the current attributes?


Jody Belka
knew (at) pimb (dot) org

This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time
by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl
Xen-devel mailing list



Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.