From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:48921) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SbiaV-0000Kg-VS for qemu-devel@nongnu.org; Mon, 04 Jun 2012 21:29:37 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1SbiaU-00014s-1n for qemu-devel@nongnu.org; Mon, 04 Jun 2012 21:29:35 -0400 Received: from cantor2.suse.de ([195.135.220.15]:52909 helo=mx2.suse.de) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SbiaT-00014h-OK for qemu-devel@nongnu.org; Mon, 04 Jun 2012 21:29:33 -0400 Mime-Version: 1.0 (Apple Message framework v1278) Content-Type: text/plain; charset=iso-8859-1 From: Alexander Graf In-Reply-To: <4FCD5F78.9090102@codemonkey.ws> Date: Tue, 5 Jun 2012 03:29:26 +0200 Content-Transfer-Encoding: quoted-printable Message-Id: <582B3619-750F-43BF-96EB-FCE454EC90CE@suse.de> References: <20120502193256.6508.86360.stgit@sifl> <4FCAB60E.1070107@codemonkey.ws> <10302697.mednriu9QL@sifl> <4FCD409C.70003@codemonkey.ws> <1E364312-A64D-4D14-90A4-89C8F2BA8A54@suse.de> <4FCD4ACF.4000809@codemonkey.ws> <4FCD5AD1.9080406@codemonkey.ws> <4FCD5F78.9090102@codemonkey.ws> Subject: Re: [Qemu-devel] [PATCH v2] vnc: disable VNC password authentication (security type 2) when in FIPS mode List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Anthony Liguori Cc: Paul Moore , qemu-devel Developers , Roman Drahtmueller On 05.06.2012, at 03:23, Anthony Liguori wrote: > On 06/05/2012 09:08 AM, Alexander Graf wrote: >>=20 >> On 05.06.2012, at 03:03, Anthony Liguori wrote: >>=20 >>> On 06/05/2012 08:55 AM, Alexander Graf wrote: >>>>=20 >>>> On 05.06.2012, at 01:54, Anthony Liguori wrote: >>>>=20 >>>>> Have you ever experienced a random failure on an SELinux box that = made no logical sense? Out of desperation, you setenforce 0 and = magically, thinks work again. >>>>=20 >>>> Yeah - I never understood how anyone thought it makes sense to = enable SELinux globally be default.... Either way, FIPS hopefully isn't = something you find enabled by accident anywhere. >>>>=20 >>>>> Even if the user enabled fips mode, they may not understand that = this means VNC authentication will stop working. Providing an option = (1) allows the user to discover what the problem is (2) makes the = behavior much more clear. >>>>=20 >>>> Where would you want the option to live? Compile time would be = useless - users don't recompile QEMU, they take binary packages. A = runtime option? Who would enable that runtime option then? Libvirt by = default I suppose? So you're back in the same hell. RH would patch = libvirt to always pass in -enable-fips and nothing would be different. >>>=20 >>> A QemuOpts option that is disabled by default but can be enabled = through /etc/qemu/target-x86_64.conf >>>=20 >>> If any distribution wants to enable it as part of the default = configuration, they certainly can. But a user can override it if they = want to. >>>=20 >>> Likewise, libvirt can enable it by default if they are so inclined. = At least the qemu logs from libvirt will show -enable-fips-mode >>>=20 >>>>=20 >>>>> Removing features based on a magic procfs variable with no input = from the user is a bad idea IMHO. >>>>=20 >>>> But it's the design of the Linux FIPS model. >>>=20 >>> Just because someone made a bad choice, that doesn't mean we have to = continue to make bad choices ourselves. >>>=20 >>> This whole feature is ridiculous from a technical perspective. As = you said, disabling VNC auth but allowing no-password to be used is = simply moronic. >>>=20 >>> I understand why we have to support these things, but it should not = be the default behavior. >>=20 >> Fair enough, but I don't think a >>=20 >> ### log file ### >>=20 >> qemu-kvm -enable-fips >>=20 >> ### end of log file ### >>=20 >> vs >>=20 >> ### log file ### >>=20 >> qemu-kvm