Re: [Qemu-devel] [PATCH 1/2] guest agent: add RPC blacklist command-line option

[Daniel P. Berrange]

On Wed, Dec 07, 2011 at 12:34:01PM +0200, Dor Laor wrote:
> On 12/07/2011 06:03 AM, Michael Roth wrote:
> >This adds a command-line option, -b/--blacklist, that accepts a
> >comma-seperated list of RPCs to disable, or prints a list of
> >available RPCs if passed "?".
> >
> >In consequence this also adds general blacklisting and RPC listing
> >facilities to the new QMP dispatch/registry facilities, should the
> >QMP monitor ever have a need for such a thing.
> 
> Beyond run time disablement, how easy it is to compile out some of
> the general commands such as exec/file-handling?
> 
> Security certifications like common criteria usually ask to compile
> out anything that might tamper security.

I don't think that's really relevant/needed. As discussed on the
call yesterday, this is security theatre, because nothing can prevent
the host admin from accessing guest RAM or disk data. AFAIK the
virtualization related security certifications acknowledge this
already & don't make any claims about security of guests against
a malicious host admin. In any case, a suitable SELinux policy for
the guest agent could prevent arbitrary file/binary access via
generic 'exec' / 'file-read' commands, in a manner that is sufficient
to satisfy security certications. 

Regards,
Daniel
-- 
|: http://berrange.com      -o-    http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org              -o-             http://virt-manager.org :|
|: http://autobuild.org       -o-         http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org       -o-       http://live.gnome.org/gtk-vnc :|