Re: [Xen-ia64-devel] [PATCH] Fix security vulnerability

[Kouya Shimura <kouya@xxxxxxxxxxxxxx>]

Isaku Yamahata writes:
> On Tue, Jan 15, 2008 at 03:52:45PM +0900, Kouya Shimura wrote:
> > DomU can map any other domain's memory.
> 
> What about add_io_space and un/expose_foreign_p2m?

I'm not sure they are breakable.
At first, I wrote the following patch. But domU never boot.
(do_dom0vp_op() is not only for dom0...)
Why don't you fix them?

===============================
unsigned long
do_dom0vp_op(unsigned long cmd,
             unsigned long arg0, unsigned long arg1, unsigned long arg2,
             unsigned long arg3)
{
    unsigned long ret = 0;
    struct domain *d = current->domain;

+   if ( !IS_PRIV(d) )
+       return -EPERM;
    switch (cmd) {
    case IA64_DOM0VP_ioremap:
===============================

Thanks,
Kouya

_______________________________________________
Xen-ia64-devel mailing list
Xen-ia64-devel@xxxxxxxxxxxxxxxxxxx
http://lists.xensource.com/xen-ia64-devel