Hi, I would like to understand the security implications between Dom0 and DomU. Dom0 = openSUSE 10.2 DomU = openSUSE 10.2 (paravirtualization) DomU = openSUSE 10.2 (full virtualization) DomU = WindowsXP (full virtualization) If I must give out the DomU root (administrator) passwords, how secure is the Dom0? Is there a difference in the security between Full and Para virtualization? Can wrapping this in something like AppArmour resolve some of the security issues (if there are any?) Thanks Thomas _______________________________________________ Xen-users mailing list Xen-users@lists.xensource.com http://lists.xensource.com/xen-users
The DomU is an independent environment and cannot access other DomU''s or the Dom0 regardless of the privaledges. Marco Jorge --- Thomas King <tking@ca.ibm.com> wrote:> Hi, > > I would like to understand the security implications between Dom0 and > > DomU. > > Dom0 = openSUSE 10.2 > DomU = openSUSE 10.2 (paravirtualization) > DomU = openSUSE 10.2 (full virtualization) > DomU = WindowsXP (full virtualization) > > If I must give out the DomU root (administrator) passwords, how > secure is > the Dom0? Is there a difference in the security between Full and Para > > virtualization? Can wrapping this in something like AppArmour resolve > some > of the security issues (if there are any?) > > Thanks > Thomas> _______________________________________________ > Xen-users mailing list > Xen-users@lists.xensource.com > http://lists.xensource.com/xen-users_______________________________________________ Xen-users mailing list Xen-users@lists.xensource.com http://lists.xensource.com/xen-users
> > The DomU is an independent environment and cannot access other DomU''s > or the Dom0 regardless of the privaledges. >It''s an interesting question though... what would be the implications if a buffer overflow was found either in the hypervisor or in a Dom0 backend device driver. Maybe a deliberately malformed disk or network request could overflow something in Dom0 and give you root access there? Can anyone in the know comment on this? Thanks James _______________________________________________ Xen-users mailing list Xen-users@lists.xensource.com http://lists.xensource.com/xen-users