WARNING - OLD ARCHIVES

This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
   
 
 
Xen 
 
Home Products Support Community News
 
   
 

xen-devel

Re: [Xen-devel] severe security issue on dom0/xend/xm/non-root users

To: Kurt Garloff <garloff@xxxxxxx>
Subject: Re: [Xen-devel] severe security issue on dom0/xend/xm/non-root users
From: Tommi Virtanen <tv@xxxxxxxxxxxxx>
Date: Fri, 18 Mar 2005 13:59:57 +0200
Cc: Xen development list <xen-devel@xxxxxxxxxxxxxxxxxxxxx>, Philip R Auld <pauld@xxxxxxxxxxx>, David Hopwood <david.hopwood@xxxxxxxxxxxxxxxx>
Delivery-date: Sat, 19 Mar 2005 01:58:50 +0000
Envelope-to: www-data@xxxxxxxxxxxxxxxxxxx
In-reply-to: <20050318093158.GE16066@xxxxxxxxxxxxxxxxx>
List-archive: <http://sourceforge.net/mailarchive/forum.php?forum=xen-devel>
List-help: <mailto:xen-devel-request@lists.sourceforge.net?subject=help>
List-id: List for Xen developers <xen-devel.lists.sourceforge.net>
List-post: <mailto:xen-devel@lists.sourceforge.net>
List-subscribe: <https://lists.sourceforge.net/lists/listinfo/xen-devel>, <mailto:xen-devel-request@lists.sourceforge.net?subject=subscribe>
List-unsubscribe: <https://lists.sourceforge.net/lists/listinfo/xen-devel>, <mailto:xen-devel-request@lists.sourceforge.net?subject=unsubscribe>
References: <20050313145512.GC29310@xxxxxxxxxxxxxxxxx> <4234B2F5.1070205@xxxxxxxxxxxxxxxx> <20050313215122.GC11358@xxxxxxxxxxxxxxxxx> <20050314145850.GB6037@xxxxxxxxxxxxxxxxxx> <20050314151652.GE11417@xxxxxxxxxxxxxxxxx> <20050314155421.GD6037@xxxxxxxxxxxxxxxxxx> <20050314161316.GM11417@xxxxxxxxxxxxxxxxx> <423927DB.3040305@xxxxxxxxxxxxx> <20050317150230.GW11685@xxxxxxxxxxxxxxxxx> <423A9D38.9080601@xxxxxxxxxxxxx> <20050318093158.GE16066@xxxxxxxxxxxxxxxxx>
Sender: xen-devel-admin@xxxxxxxxxxxxxxxxxxxxx
User-agent: Debian Thunderbird 1.0 (X11/20050116)
Kurt Garloff wrote:
You're very flexible in your setuid root client.

1. You may restrict the set of users that is able to call the client,
e.g. it might be root:trusted 4750. This would impose the same restrictions as your group protection mechanism.

With the group-protected unix domain socket, you don't need any code
to do that.

2. The first thing the client does it to acquire the privileged port and then drop capabilities immediately afterwards. Security
   flaws in the client will thus at most grant the exploiter a
   privileged socket. (This has nothing to do with xen, just a
   general rule for setuid root apps.)

With the group-protected unix domain socket, security flaws in the
client will at most grant a not-used-for-anything-else group membership,
which allows one to connect to the xend socket.

That is, security flaws in the client will never be able to directly
give the attacker root access.

Also, xend can only be attacked by people in the group, where as
xend listening on 127.0.0.1 can be attacked by any local user.

3. The client can impose whatever restrictions it likes, e.g.
   checking SSL certificates, asking for passwords, checking
   a configuration file, whatever.

That's equally true for unix domain sockets.

I don't see a big difference in neither flexibility nor security.

So you really _want_ to add yet another unnecessary setuid app, where
one really is not needed?


-------------------------------------------------------
SF email is sponsored by - The IT Product Guide
Read honest & candid reviews on hundreds of IT Products from real users.
Discover which products truly live up to the hype. Start reading now.
http://ads.osdn.com/?ad_id=6595&alloc_id=14396&op=click
_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxxx
https://lists.sourceforge.net/lists/listinfo/xen-devel

<Prev in Thread] Current Thread [Next in Thread>