From: Ian Jackson <ian.jackson@eu.citrix.com>
To: xen-devel@lists.xensource.com
Cc: Ross Lagerwall <ross.lagerwall@citrix.com>,
Stefano Stabellini <sstabellini@kernel.org>,
Wei Liu <wei.liu2@citrix.com>
Subject: [PATCH v2 00/24] Provide some actual restriction of qemu
Date: Wed, 4 Oct 2017 16:57:06 +0100 [thread overview]
Message-ID: <1507132650-25376-1-git-send-email-ian.jackson@eu.citrix.com> (raw)
With this series, it is possible to run qemu in a way that I think
really does not have global privilege any more>
I have verified that it runs as a non-root user. I have checked all
of its fds and they are either privcmd (which I have arranged to
neuter), or /dev/null, or harmless sockets and pipes, or evtchn.
Unfortunately this needs a new "xentoolcore" library, which all the
existing libraries register with so that the restrict call is
effective.
Also there are a number of lacunae. In particular:
- if we are not using a shared uid, we should kill all processes
belonging to the chosen uid both at domain start time and at
domain shutdown time
- we should have qemu chroot
- some audit and/or review of the resulting situation would be
good before we offer security support for the new boundary
- use of rlimits may be useful to mitigate the risk of DOS
by a compromised qemu
- cdrom insert would have to be done via fd passing and is not
yet implemented
- we need to think about what happens during migration (currently
privileges are dropped very late, certainly after the receiving
qemu has read the migration stream from its
now-supposedly-untrusted peer)
The series depends for its functionality on the qemu series I have
just posted, but should be harmless without the new qemu patches
(except for the build compatibility patch to link against
xentoolcore).
I won't list the changes since v1. They are minor and are the result
of review comments.
This repost is based on today's xen.git#master. It will need rebase
onto staging before committing, obviously, but that shouldn't be hard.
Thanks,
Ian.
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xen.org
https://lists.xen.org/xen-devel
next reply other threads:[~2017-10-04 15:57 UTC|newest]
Thread overview: 36+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-10-04 15:57 Ian Jackson [this message]
2017-10-04 15:57 ` [PATCH 01/24] xen: Provide XEN_DMOP_remote_shutdown Ian Jackson
2017-10-04 15:57 ` [PATCH 02/24] xen: x86 dm_op: add missing newline before XEN_DMOP_inject_msi Ian Jackson
2017-10-04 15:57 ` [PATCH 03/24] tools: libxendevicemodel: Provide xendevicemodel_shutdown Ian Jackson
2017-10-05 11:39 ` Wei Liu
2017-10-04 15:57 ` [PATCH 04/24] xentoolcore, _restrict_all: Introduce new library and implementation Ian Jackson
2017-10-06 17:41 ` Ross Lagerwall
2017-10-04 15:57 ` [PATCH 05/24] xentoolcore: Link into stubdoms Ian Jackson
2017-10-05 11:40 ` Wei Liu
2017-10-04 15:57 ` [PATCH 06/24] tools: qemu-xen build: prepare to link against xentoolcore Ian Jackson
2017-10-04 15:57 ` [PATCH 07/24] libxl: #include "xentoolcore_internal.h" Ian Jackson
2017-10-04 15:57 ` [PATCH 08/24] tools: move CONTAINER_OF to xentoolcore_internal.h Ian Jackson
2017-10-04 15:57 ` [PATCH 09/24] xentoolcore_restrict_all: Implement for libxendevicemodel Ian Jackson
2017-10-05 11:40 ` Wei Liu
2017-10-04 15:57 ` [PATCH 10/24] xentoolcore_restrict_all: "Implement" for libxencall Ian Jackson
2017-10-04 15:57 ` [PATCH 11/24] xentoolcore_restrict: Break out xentoolcore__restrict_by_dup2_null Ian Jackson
2017-10-04 15:57 ` [PATCH 12/24] xentoolcore_restrict_all: Implement for libxenforeignmemory Ian Jackson
2017-10-05 11:41 ` Wei Liu
2017-10-04 15:57 ` [PATCH 13/24] xentoolcore_restrict_all: Declare problems due to no evtchn support Ian Jackson
2017-10-04 15:57 ` [PATCH 14/24] xentoolcore_restrict_all: "Implement" for xengnttab Ian Jackson
2017-10-04 15:57 ` [PATCH 15/24] tools/xenstore: get_handle: use "goto err" error handling style Ian Jackson
2017-10-04 15:57 ` [PATCH 16/24] tools/xenstore: get_handle: Allocate struct before opening fd Ian Jackson
2017-10-04 15:57 ` [PATCH 17/24] xentoolcore_restrict_all: "Implement" for xenstore Ian Jackson
2017-10-04 15:57 ` [PATCH 18/24] xentoolcore, _restrict_all: Document implementation "complete" Ian Jackson
2017-10-05 11:41 ` Wei Liu
2017-10-04 15:57 ` [PATCH 19/24] xl, libxl: Provide dm_restrict Ian Jackson
2017-10-04 15:57 ` [PATCH 20/24] libxl: Rationalise calculation of user to run qemu as Ian Jackson
2017-10-05 11:49 ` Wei Liu
2017-10-04 15:57 ` [PATCH 21/24] libxl: libxl__dm_runas_helper: return pwd Ian Jackson
2017-10-04 15:57 ` [PATCH 22/24] libxl: userlookup_helper_getpwnam rename and turn into a macro Ian Jackson
2017-10-04 15:57 ` [PATCH 23/24] libxl: dm_restrict: Support uid range user Ian Jackson
2017-10-05 11:50 ` Wei Liu
2017-10-04 15:57 ` [PATCH 24/24] tools: xentoolcore_restrict_all: use domid_t Ian Jackson
2017-10-05 11:50 ` Wei Liu
2017-10-09 15:57 [PATCH v2 00/24] Provide some actual restriction of qemu Ian Jackson
2017-10-09 16:10 ` Ian Jackson
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1507132650-25376-1-git-send-email-ian.jackson@eu.citrix.com \
--to=ian.jackson@eu.citrix.com \
--cc=ross.lagerwall@citrix.com \
--cc=sstabellini@kernel.org \
--cc=wei.liu2@citrix.com \
--cc=xen-devel@lists.xensource.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.