| |
|
 |
|
 |
|
|
|
| |
|
|
xen-devel
Re: [Xen-devel] Re: Module loading in unpriveledged domains
Nuutti Kotivuori wrote:
David Hopwood wrote:
True, unless there are bugs that cause different behaviour depending
on whether a module is compiled-in or loaded (such as
<http://lists.jammed.com/linux-security-module/2003/12/0012.html>).
Nevertheless enabling loadable modules may allow a greater
proportion of script kiddies to be capable of exploiting any given
bug.
This is all the same as in standard Linux, so perhaps I should have
said: enable loadable modules iff you would do so in standard Linux.
That's a bit of an odd comment I think.
Enabling module loading has security implications for the actual Linux
system being exploited - eg. either the physical machine in a
standalone case, or a Xen guest virtual machine.
But the original question was not about the security of that machine,
but about the possibility of escalation of that exploit into other
Xen guests or the domain 0 on the same physical machine.
If there is no exploit, then there is no possibility of escalation.
On a physical machine running Linux on Xen where an attacker only has
direct access to Linux user-mode processes, the attacker has two layers
that must both be exploited: Linux and Xen. Obviously, bugs and
misconfigured settings in both Linux and Xen are therefore relevant
to the security of the physical machine.
--
David Hopwood <david.nospam.hopwood@xxxxxxxxxxxxxxxx>
-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://productguide.itmanagersjournal.com/
_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxxx
https://lists.sourceforge.net/lists/listinfo/xen-devel
|
|
|
| |
|
Home