[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] Re: [Xen-devel] severe security issue on dom0/xend/xm/non-root users
Hi David, On Sun, Mar 13, 2005 at 09:39:01PM +0000, David Hopwood wrote: > Kurt Garloff wrote: > >Why not just require the other end of the socket to be below 1024? > > Please don't. The permission should be something that can be specifically > granted to a user or group id, not that requires root. Requiring root > tends to cause as many security problems as it solves. I disagree. Normally, you'd expect that only the sysadmin is able to control virtual machines. This would be the result of this simple tweak. Security problems start when you start using setuid to grant this privilege to others; to make it secure, we'd need to bind a socket and then drop all privileges. Not too hard to do in a secure way IMVHO. > >Using an selinux policy for this would be aiming cannons at sparrows > >(german saying, in english that's breaking a fly on the wheel). > > "using a sledgehammer to crack a nut". :-) Regards, -- Kurt Garloff <kurt@xxxxxxxxxx> [Koeln, DE] Physics:Plasma modeling <garloff@xxxxxxxxxxxxxxxxxxx> [TU Eindhoven, NL] Linux: SUSE Labs (Director) <garloff@xxxxxxx> [Novell Inc] Attachment:
pgpyM3RMGKDBY.pgp
|
![]() |
Lists.xenproject.org is hosted with RackSpace, monitoring our |