linux-trace-users.vger.kernel.org archive mirror
 help / color / mirror / Atom feed
From: Steven Rostedt <rostedt@goodmis.org>
To: Stefan Hajnoczi <stefanha@redhat.com>
Cc: Stefan Hajnoczi <stefanha@gmail.com>,
	Luiz Capitulino <lcapitulino@redhat.com>,
	kvm@vger.kernel.org, yoshihiro.yunomae.ez@hitachi.com,
	mtosatti@redhat.com, qemu-devel@nongnu.org,
	linux-trace-users@vger.kernel.org, peterx@redhat.com,
	pbonzini@redhat.com
Subject: Re: [Qemu-devel] [RFC] host and guest kernel trace merging
Date: Mon, 7 Mar 2016 10:49:24 -0500	[thread overview]
Message-ID: <20160307104924.1871dbdb@gandalf.local.home> (raw)
In-Reply-To: <20160307151705.GD20937@stefanha-x1.localdomain>

On Mon, 7 Mar 2016 15:17:05 +0000
Stefan Hajnoczi <stefanha@redhat.com> wrote:


> qemu-guest-agent runs inside the guest and replies to RPC commands from
> the host.  It is used for backups, shutdown, network configuration, etc.
> From time to time people have wanted the ability to execute an arbitrary
> command inside the guest and return the output.  This functionality has
> never been merged, probably for the security reason.

How's the connection set up. That is, how does it know the commands are
coming from the host? And how does it know that the commands from the
host is from a trusted source? If the host is compromised, is there
anything keeping an intruder from controlling the guest?

> 
> A tracing server that runs inside the guest is comparable to
> qemu-guest-agent.  As long as the tracing server requires manual
> commands to start it and does not run by default, then I think the
> security issue can be kept at bay.  It's a powerful tool that requires
> explicit guest administrator action to enable.

This isn't something I would expect to be started by default. My worry
is that once it is started, then you open up a connection that can be
attached by pretty much anyone. We could make a network socket that
only communicates with the host, but even that worries me. I'm worried
that the host may have actors that might compromise the system.

-- Steve

  parent reply	other threads:[~2016-03-07 15:49 UTC|newest]

Thread overview: 3+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <20160303143501.0edf21a2@redhat.com>
     [not found] ` <20160304111933.GB626@stefanha-x1.localdomain>
2016-03-04 13:23   ` [Qemu-devel] [RFC] host and guest kernel trace merging Steven Rostedt
     [not found]     ` <20160307151705.GD20937@stefanha-x1.localdomain>
2016-03-07 15:49       ` Steven Rostedt [this message]
     [not found]         ` <56DDA7E2.3050506@redhat.com>
2016-03-07 16:26           ` Steven Rostedt

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20160307104924.1871dbdb@gandalf.local.home \
    --to=rostedt@goodmis.org \
    --cc=kvm@vger.kernel.org \
    --cc=lcapitulino@redhat.com \
    --cc=linux-trace-users@vger.kernel.org \
    --cc=mtosatti@redhat.com \
    --cc=pbonzini@redhat.com \
    --cc=peterx@redhat.com \
    --cc=qemu-devel@nongnu.org \
    --cc=stefanha@gmail.com \
    --cc=stefanha@redhat.com \
    --cc=yoshihiro.yunomae.ez@hitachi.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).