Re: [Xen-users] Best way to use Xen to segment & protect

[weiming <zephyr.zhao@xxxxxxxxx>]

Hi Nick,

In which situation can domU root
escalation result in escalation to dom0?
If domU has no virtual NIC configured, will the threat still exist?

weiming

On Tue, Feb 17, 2009 at 4:41 PM, Nick Anderson <nick@xxxxxxxxxxxx> wrote:

On Tue, Feb 17, 2009 at 01:29:29PM -0800, Rick Flower wrote:
> Thanks for the info Nick... Regarding the root escalation mentioned
> above -- have there been issues with this in the past?

Yes I believe so
http://secunia.com/advisories/26986/

> Also, I guess it would help to have the domU that Apache is using to
> have tools such as Tripwire and other related tools to keep thing from
> getting too far...

Inside a domU you would want any protections you would have on any
other server.

> If you're in a domU, can you tell that it's a virtual server?  If not
> then perhap it's less likely to break out and escalate to dom0...?

Yes if its a paravirtualized machine.

> Is it possible to have a domU mount a different filesystem than dom0?
> Sorry for the numerous questions...

Not quite sure what you mean here.


--

Nick Anderson <nick@xxxxxxxxxxxx>

http://www.cmdln.org


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iEYEARECAAYFAkmbLvgACgkQXkxp94vgneadyQCeJi7asoe76GoNsGP薳舟䡼
Co8AoIXovsJ7ESdPCpplNiqcYjaLX2Se
=ItZu
-----END PGP SIGNATURE-----

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users

_______________________________________________
Xen-users mailing list
Xen-users@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-users