Re: [Xen-devel] [PATCH v2] xsm: hide detailed Xen version from unprivileged guests

[Doug Goldstein <cardoe@xxxxxxxxxx>]

On 1/10/20 9:28 AM, George Dunlap wrote:
> On 1/10/20 11:02 AM, Andrew Cooper wrote:
> > On 10/01/2020 10:37, Sergey Dyasli wrote:
> > > Hide the following information that can help identify the running Xen
> > > binary version: XENVER_extraversion, XENVER_compile_info, XENVER_changeset.
> > > Add explicit cases for XENVER_commandline and XENVER_build_id as well.
> > >
> > > Introduce xsm_filter_denied() to hvmloader to remove "<denied>" string
> > > from guest's DMI tables that otherwise would be shown in tools like
> > > dmidecode.
> > >
> > > Signed-off-by: Sergey Dyasli <sergey.dyasli@xxxxxxxxxx>
> > > ---
> > > v1 --> v2:
> > > - Added xsm_filter_denied() to hvmloader instead of modifying xen_deny()
> > > - Made behaviour the same for both Release and Debug builds
> > > - XENVER_capabilities is no longer hided
> > >
> > > CC: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
> > > CC: George Dunlap <George.Dunlap@xxxxxxxxxxxxx>
> > > CC: Ian Jackson <ian.jackson@xxxxxxxxxxxxx>
> > > CC: Jan Beulich <jbeulich@xxxxxxxx>
> > > CC: Julien Grall <julien@xxxxxxx>
> > > CC: Konrad Rzeszutek Wilk <konrad.wilk@xxxxxxxxxx>
> > > CC: Stefano Stabellini <sstabellini@xxxxxxxxxx>
> > > CC: Wei Liu <wl@xxxxxxx>
> > > CC: Daniel De Graaf <dgdegra@xxxxxxxxxxxxx>
> > I realise there are arguments over how to fix this, but we (the Xen
> > community) have already f*cked up once here, and this is doing so a
> > second time.
> >
> > Nack.
> >
> > Fixing it anywhere other than Xen is simply not appropriate.
> >
> > The reason for this (which ought to be obvious, but I guess only to
> > those who actually do customer support) is basic human physiology.
> > "denied" means something has gone wrong.  It scares people, and causes
> > them to seek help to change fix whatever is broken.
> This seems like a reasonable argument that "<denied>" causes issues.
> But that doesn't change the fact that "" also causes issues.
I'd be curious to hear the case where the empty string causes issues.

--
Doug

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel