Re: [Xen-devel] Xend listening for TCP HTTP?

[Anthony Liguori <aliguori@xxxxxxxxxx>]

Nivedita Singhvi wrote:

> Anthony Liguori wrote:
>
> > Ok, I confirmed this, out of the box, accessing 
> > http://localhost:8000/xen/domain as a lesser-privileged user allows 
> > one to do very bad things.
>
> Anthony, were you using the default xend-config.sxp?
Yup.

> Currently, although the default is off for http support
> in xend, the default config file turns it on:
>
> #(xend-http-server no)
> (xend-http-server yes)
Yup.  This was added in:

# HG changeset patch
# User emellor@xxxxxxxxxxxxxxxxxxxxxx
# Node ID cefe36be8592090b4edb08060cca67a004c04617
# Parent  4d49f61a7feef3fca5fb3e991a5a1d741b6cd690
Tidy xend-config.sxp, removing entries that haven't been used since the
hotplugging stuff was introduced (block-*, console-port-base, 
console-address)
and introducing entries for options that have been present for ages
(xend-{http,unix,relocation}-server, xend-unix-path, 
xend-relocation-address,
enable-dump).  Remove vif-antispoof, as Vifctl no longer passes this option
down.

I imagine it was unintentional.  Ewan?

Regards,

Anthony Liguori

> thanks,
> Nivedita
>
> > Regards,
> >
> > Anthony Liguori
> >
> > Anthony Liguori wrote:
> >
> > > Hi,
> > >
> > > On IRC, it came up that recent snapshots of Xend are now listening 
> > > for TCP HTTP connections again by default.  Since it's still 
> > > listening on a Unix socket and xm will always prefer that, xm still 
> > > only functions as root.
> > > However, less privileged users can still connect to the TCP port and 
> > > through Xend gain root access.  This seems like a pretty bad default 
> > > configuration.  I poked around on the TCP interface but couldn't 
> > > seem to confirm this (does it only accept s-expression Content-Type 
> > > now?).
> > > Thanks for any clarification on this.
> > >
> > > Regards,
> > >
> > > Anthony Liguori
> > >
> > > _______________________________________________
> > > Xen-devel mailing list
> > > Xen-devel@xxxxxxxxxxxxxxxxxxx
> > > http://lists.xensource.com/xen-devel
> >
> > _______________________________________________
> > Xen-devel mailing list
> > Xen-devel@xxxxxxxxxxxxxxxxxxx
> > http://lists.xensource.com/xen-devel

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-devel