On Tue, Feb 01, 2005 at 12:00:17AM -0000, Ian Pratt wrote:
> > > I can't see why making the frontend MAC readonly can really be done
> > > securely within the domain.
> >
> > Well, if you have module support enabled in the kernel, or some way
> > that lets root write to random (domain) memory, then it's not really
> > secure, although i think it's still a nice to have. Otherwise i would
> > think it should be reasonably secure?
>
> You need root access to change the mac normally, and its trivial for
> root to change it under your scheme -- running sed on /dev/mem would do
> it...
I was thinking of something along the lines of adding a tiny bit of code
to remove the CAP_SYS_MODULE and CAP_SYS_RAWIO capabilities from the global
set of allowed cap's when using the readonly option. With that in place you're
down to requiring a kernel-hole to get around it.
> > > > (2) the addition of some xen-specific sysfs attributes
> > > > on front/back vifs,
> > >
> > > What attributes?
> >
> > Backend:
> > - xen/fe.domain: frontend domain name
> > - xen/fe.initial_address: initial frontend interface mac address
> > - xen/fe.mac_mode: mac mode of the frontend interface (r/w)
> > - xen/be.mac_mode: mac mode of the backend interface (r/w)
> >
> > Frontend:
> > - xen/mac_mode: mac mode of the interface
>
> What's the naming convention for multiple fe/bs's.
Ah, sorry. I've had my head stuck in the sysfs system so much lately
I didn't get enough context. Network interfaces appear within sysfs as:
/sys/class/net/INTNAME
so, eg, /sys/class/net/vif1.0. The paths above are located within that,
so you'd have /sys/class/net/vif1.0/xen/fe.initial_address
> I can see some point having the be enforce the MAC, and possibly in
> having the enforcement address being configurable via sysfs. I'm not a
> big fan of this section of the patch, though.
The entire idea of it or just the current attributes?
J
--
Jody Belka
knew (at) pimb (dot) org
-------------------------------------------------------
This SF.Net email is sponsored by: IntelliVIEW -- Interactive Reporting
Tool for open source databases. Create drag-&-drop reports. Save time
by over 75%! Publish reports on the web. Export to DOC, XLS, RTF, etc.
Download a FREE copy at http://www.intelliview.com/go/osdn_nl
_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxxx
https://lists.sourceforge.net/lists/listinfo/xen-devel
|
Home