[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Xen-users] Re: malicious paravirtualized guests: security and isolation
- To: xen-users@xxxxxxxxxxxxxxxxxxx
- From: "Vasiliy Baranov" <vasiliy.baranov@xxxxxxxxx>
- Date: Fri, 14 Nov 2008 21:39:01 +0300
- Delivery-date: Fri, 14 Nov 2008 10:41:00 -0800
- Domainkey-signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=message-id:date:from:to:subject:in-reply-to:mime-version :content-type:references; b=TEWbiT7qBi3yAaVeM8IaD6qw0cSiFZsv1pyWpHYSTaJxWIrnudVvwd9bm+JIc3+Nz1 7iuDcut1/O8Om+zCVdBdYXVH/ZtUveut/ipTn3h5lqh+X4x0sAFdCMqt565cuDUrk12f s0IBCSziOsslFSBqFPOnZcWsi3r3wOQ7OHOE0=
- List-id: Xen user discussion <xen-users.lists.xensource.com>
On Tue, Nov 11, 2008 at 10:59 PM, George Lenzer <george.lenzer@xxxxxxx> wrote:
>>>With the kernels and modules, I think that it would only be wise for you to restrict them to the kernel you provide. >> Why? Why it matters (if Xen is designed to provide isolation anyways)?
Not a technical reason, but more a "paranoid" approach just in case there is something flawed in the Xen design. However, saying that, I personally wouldn't have a problem with custom kernel modules other than the administration headaches (maybe rsync or an svn repository would be wise).
>>>Regarding the security of running their own modules, it I still believe that they would not be able to cross the boundaries of their domain into other domains via this route. Unless something is seriously broken in
>>>the Xen paravirtualization model, when they are in unprivileged domains, they can't access anything that Domain0/Xen microkernel doesn't allow.
>>I am far from being Linux expert but I thought a module can override anything in the kernel. Am I wrong? If am not wrong, why disallowing custom kernels while still allowing custom modules can be different
>>from allowing custom kernels?
I welcome any correction on my thinking, but if I understand it correctly, when you boot a paravirtualized domU, it is using it's own instance of the domU kernel in RAM. It is not sharing a kernel with Dom0. They are the same kernel in terms of the binary, but the memory space and virtual resource allocated to Domain0 are not accessible to any unprivileged domain in any way. This is why I chose Xen over OpenVZ for my own needs. I wanted something that didn't share a kernel instance at all, and that's what Xen PVs offer.
Sure. We are not talking about sharing the kernel between dom0 and domU. domUs are going to have completely different kernels anyways. The question is, if I have to allow custom modules in domUs (because my users cannot live without them), does it make sense to disallow custom kernels, i.e. whether disallowing custom kernels is going to buy me much?
Thank you,
Vasiliy
_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users
|
