Re: [Xen-users] Running workstation and firewall on the same hardware

[Mark Williamson <mark.williamson@xxxxxxxxxxxx>]

> > This is interesting. How robust is the isolation between domains and
> > what are the possible risks?
>
> I just skimmed through my mail-backlog today, but there was one post in
> the recent days that summed up to:
>
> "A domain with access to a PCI (bus)master device can abuse this
> abilities to overwrite arbitrtary memmory locations"
>
> So, after you owned the DomU that has controll of the network card, you
> have to twaeke it into loading a new driver for the network card, that
> abuses the PCI busmaster capabilities to overwrite some memory of the
> supervisor to breake out of the DomU.
>
> while this is known to be easy (for complicated values of easy) to do
> with a firewire device/port I don't think you have anything to fear.
>
> If I were to face a hacket that is able to do that (remotely), she has
> much lowerhanging fruits to pick on the rest of my systems ;-)

Absolutely.  You'd need to devise an attack that can abuse the specific 
device's DMA capabilities in some cunning way to capture sensitive 
information or overwrite it.  This would be rather fiddly...  You can also 
impede this by standard measures such as running tripwire over the 
filesystem, a kernel without modules support, etc.

> > From what you wrote it seems that allowing domU access to the hardware
> > is more risky than passing all packets to domU through dom0.
>
> Yes and no. You'd have to studdy the PCI busmaster capabilities of your
> networkcard to know for sure.
>
> moving the hardware access to one domU has the advantage that you can
> reboot the "driver domain" when required. But it's more complicated to
> set up. Personaly I've never tried to do that. handling all hardware
> access in dom0 was fine with me.

It's not *terribly* complicated but it is a bit of a fiddle.  We could do with 
making this a bit friendlier.  A nice hack would be to abuse Linux's PCI 
hotplug support to allow PCI cards to be dynamically reassigned - then we 
could just provide a GUI for "Give domain this device".

Cheers,
Mark

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users