Re: [Xen-users] Protect data inside domU

[Jonathan Tripathy <jonnyt@xxxxxxxxxxx>]

On 17/06/2012 11:10, Niu Xinli wrote:
> Hi,
>     Normally dom0 root can directly mount domU's virtual hard disk and 
> see what's in it. Does xen offer a mechanism that can protect domU 
> data from curious/malicious administrators?   We are building a 
> private cloud and wander if we can add such a function. Any help is 
> greatly appreciated.
> Best Regards,
> Xinli
The principal of the Dom0 is that it is "trusted". You can think of it 
as the same as the owner/administrator of the physical machine. As such, 
it would be near impossible to add such a function. You could make 
things harder by making the DomUs do some filesystem encryption inside 
their environment, where the key/password is asked for upon boot, 
however please understand that this key will be stored in RAM, which the 
Dom0 administrator still has access to.
_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxx
http://lists.xen.org/xen-users