Re: [Xen-devel] Xend listening for TCP HTTP?

[Nivedita Singhvi <niv@xxxxxxxxxx>]

Anthony Liguori wrote:
> Ok, I confirmed this, out of the box, accessing 
> http://localhost:8000/xen/domain as a lesser-privileged user allows one 
> to do very bad things.
Anthony, were you using the default xend-config.sxp?

Currently, although the default is off for http support
in xend, the default config file turns it on:

#(xend-http-server no)
(xend-http-server yes)

Note that it is restricted to local users, though:

# Address xend should listen on for HTTP connections, if xend-http-server is
# set.
# Specifying 'localhost' prevents remote connections.
# Specifying the empty string '' (the default) allows all connections.
#(xend-address '')
(xend-address localhost)

I'm about to submit a patch to turn this off in the default
file that's installed, as it's generally the case that most
people won't change it...

thanks,
Nivedita

> Regards,
>
> Anthony Liguori
>
> Anthony Liguori wrote:
>
> > Hi,
> >
> > On IRC, it came up that recent snapshots of Xend are now listening for 
> > TCP HTTP connections again by default.  Since it's still listening on 
> > a Unix socket and xm will always prefer that, xm still only functions 
> > as root.
> > However, less privileged users can still connect to the TCP port and 
> > through Xend gain root access.  This seems like a pretty bad default 
> > configuration.  I poked around on the TCP interface but couldn't seem 
> > to confirm this (does it only accept s-expression Content-Type now?).
> > Thanks for any clarification on this.
> >
> > Regards,
> >
> > Anthony Liguori
> >
> > _______________________________________________
> > Xen-devel mailing list
> > Xen-devel@xxxxxxxxxxxxxxxxxxx
> > http://lists.xensource.com/xen-devel
>
> _______________________________________________
> Xen-devel mailing list
> Xen-devel@xxxxxxxxxxxxxxxxxxx
> http://lists.xensource.com/xen-devel

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel