[libvirt] [PATCH RFC] lib: Forbid guest interaction with RO connections in virDomainGetVcpusFlags
Eric Blake
eblake at redhat.com
Tue Jul 16 15:46:49 UTC 2013
On 07/16/2013 08:37 AM, Peter Krempa wrote:
> Don't allow guest agent interaction by read-only connections as the
> agent may be mailicious.
s/mailicious/malicious/
> ---
> src/libvirt.c | 6 ++++++
> 1 file changed, 6 insertions(+)
Do we have any other commands that a read-only connection can use to
interact with a guest agent? A quick check shows that many other
commands with an AGENT flag already require read-only connections at all
times (such as virDomainReboot, virDomainSendProcessSignal,
virDomainSetVcpusFlags, and virDomainSnapshotCreateXML), but at least
virDomainGetHostname is permitted on a read-only connection with an
allowance for guest agent interaction.
Also, I'm wondering if we also need any work in the ACL framework for
controlling whether a command is permitted to require guest interaction.
For example, does it make sense to have an ACL that says a guest
shutdown via ACPI is permitted (it does not matter if the guest
responds), but a guest shutdown via the agent should be prevented
(because interacting with the agent of a malicious guest is too risky)?
At any rate, I think we need a v2 that covers all possible agent
interaction commands, if we are going to go with this approach (but the
idea does make sense to me).
--
Eric Blake eblake redhat com +1-919-301-3266
Libvirt virtualization library http://libvirt.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 621 bytes
Desc: OpenPGP digital signature
URL: <http://listman.redhat.com/archives/libvir-list/attachments/20130716/16bdc6ce/attachment-0001.sig>
More information about the libvir-list
mailing list