[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [Xen-devel] severe security issue on dom0/xend/xm/non-root users
Bastian informed me on irc of a very severe security problem with xen. A normal user can run xm, which then just communicates using tcp to xend, to do the work. This allows a normal user to create domains, which then allows a normal user to be able to access block devices. Doing chmod 700 on the xm binary won't help, as the user could just copy the files. My suggestion is to have an auth file of some kind in /etc/xen, chmod 700, that both xend and xm can then read. They'd then have to use https to communicate. But that's only if you stick with python. Unix domain sockets don't have this problem, as they can query the userid at the other end of the socket. ------------------------------------------------------- SF email is sponsored by - The IT Product Guide Read honest & candid reviews on hundreds of IT Products from real users. Discover which products truly live up to the hype. Start reading now. http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click _______________________________________________ Xen-devel mailing list Xen-devel@xxxxxxxxxxxxxxxxxxxxx https://lists.sourceforge.net/lists/listinfo/xen-devel
|
![]() |
Lists.xenproject.org is hosted with RackSpace, monitoring our |