On Tue, Mar 27, 2007 at 02:06:42PM -0700, Christian Limpach wrote:

Well SDL isn't exposed to the network directly - to access the monitor via the SDL console, you'd need to first access the X server desktop in question. Unprivileged local users, or remote user can't typically get access to X desktop of the person who started the VM, so its not neccessary to disable it.

The console enables the users to map the virtual serial port onto a physical device. Not a huge issue, but still basically a privilege escalation because it lets users access hardware they'd not otherwise be able to.

Yes, long term I expect that if we want to avoid Xen forking still further from QEMU then we'll need XenD itself to own the monitor channel, because the monitor is becoming the official way to reconfig stuff on the fly. So if XenD redirected the monitor to a STDIN/SDOUT then it could safely have complete control over it & not expose it to the user. This is the approach we already take in libvirt for managing QEMU & KVM guests & it works quite well. I didn't do that myself because its much more work & I was prioritizing the security fix.

NB, this fix is slightly different from what we actually put in RHEL. The RHEL version removed the code completely - this version allows it to be toggled at build time because Keir wanted to keep access for developers who are doing debugging of HVM guests.

Regards, Dan.