[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Xen-devel] Re: [Xen-staging] [xen-unstable] hvm: Remove access to QEMU monitor inVNC server



Christian Limpach wrote:
hvm: Remove access to QEMU monitor in VNC server

This fixes a RHEL5 errata and CVE-2007-0998.

The monitor is still accessible in debug builds of ioemu (debug=y).

Signed-off-by: Daniel P. Berrange <berrange@xxxxxxxxxx>

This change is quite weird since it doesn't disable monitor access when
using SDL.

Also, the additional virtual consoles can be used for giving access to
things without security implications, like serial ports.

I think a much better fix for the security issue would be to change the
default monitor output not to be a virtual console.

QEMU 0.9.0 supports redirecting the monitor to a unix socket and supports reconnecting to the monitor (so that the banner is shown each time).

When using these options, you can actually execute monitor commands from the command line by doing something like:

echo help | socat stdin unix:/path/to/socket

With these patches (or by moving qemu-dm up to 0.9.0), someone could add an xm monitor command that let you execute commands via xm.

That, IMHO, would be the best possible solution.

Regards,

Anthony Liguori

    christian

---
 tools/ioemu/Makefile.target |    4 ++++
 tools/ioemu/vnc.c           |   13 +++++++++++--
 2 files changed, 15 insertions(+), 2 deletions(-)

diff -r a9a39cc52e74 -r 3375391fb0c9 tools/ioemu/Makefile.target
--- a/tools/ioemu/Makefile.target       Tue Mar 27 16:19:25 2007 +0100
+++ b/tools/ioemu/Makefile.target       Tue Mar 27 16:23:52 2007 +0100
@@ -193,6 +193,10 @@ LIBS+=-lsocket -lnsl -lresolv
 LIBS+=-lsocket -lnsl -lresolv
 endif
+ifeq ($(debug),y)
+CFLAGS += -DQEMU_VNC_MONITOR_EXPORT
+endif
+
 # profiling code
 ifdef TARGET_GPROF
 LDFLAGS+=-p
diff -r a9a39cc52e74 -r 3375391fb0c9 tools/ioemu/vnc.c
--- a/tools/ioemu/vnc.c Tue Mar 27 16:19:25 2007 +0100
+++ b/tools/ioemu/vnc.c Tue Mar 27 16:23:52 2007 +0100
@@ -113,8 +113,10 @@ struct VncState
     int visible_w;
     int visible_h;
+#ifdef QEMU_VNC_MONITOR_EXPORT
     int ctl_keys;               /* Ctrl+Alt starts calibration */
     int shift_keys;             /* Shift / CapsLock keys */
+#endif
     int numlock;
 };
@@ -895,6 +897,7 @@ static void do_key_event(VncState *vs, i
            kbd_put_keycode(keycode & 0x7f);
        else
            kbd_put_keycode(keycode | 0x80);
+#ifdef QEMU_VNC_MONITOR_EXPORT
     } else if (down) {
        int qemu_keysym = 0;
@@ -922,8 +925,10 @@ static void do_key_event(VncState *vs, i
        }
        if (qemu_keysym != 0)
            kbd_put_keysym(qemu_keysym);
-    }
-
+#endif
+    }
+
+#ifdef QEMU_VNC_MONITOR_EXPORT
     if (down) {
        switch (sym) {
        case XK_Control_L:
@@ -976,6 +981,10 @@ static void do_key_event(VncState *vs, i
            break;
        }
     }
+#else
+    if (!down && sym == XK_Num_Lock)
+        vs->numlock = !vs->numlock;
+#endif
 }
static void key_event(VncState *vs, int down, uint32_t sym)

_______________________________________________
Xen-staging mailing list
Xen-staging@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-staging



_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel


 


Rackspace

Lists.xenproject.org is hosted with RackSpace, monitoring our
servers 24x7x365 and backed by RackSpace's Fanatical Support®.