linux-kernel - Re: PING^7 (was Re: [PATCH v2 00/14] Corrections and customization of the SG

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date:	Wed, 22 May 2013 14:11:35 -0400
From:	Theodore Ts'o <tytso@....edu>
To:	Paolo Bonzini <pbonzini@...hat.com>
Cc:	"Martin K. Petersen" <martin.petersen@...cle.com>,
	Tejun Heo <tj@...nel.org>,
	"James E.J. Bottomley" <JBottomley@...allels.com>,
	Jens Axboe <axboe@...nel.dk>, linux-kernel@...r.kernel.org,
	linux-scsi@...r.kernel.org
Subject: Re: PING^7 (was Re: [PATCH v2 00/14] Corrections and customization
 of the SG_IO command whitelist (CVE-2012-4542))

On Wed, May 22, 2013 at 07:00:14PM +0200, Paolo Bonzini wrote:
> You have hardware providers selling cloud services that want to run
> their own custom backup services from within a VM, which entails having
> vendor-specific commands run from within a VM.  Or you have people that
> run clusters that are half-physical and half-virtual and want to use the
> same /dev/disk/by-id paths in both cases; perhaps, with NPIV, they want
> to use one zoning approach for both physical and virtual machines.
> Someone else they want to backup to tapes from a VM (for example s390
> people who just put everything in a VM, so the distinction of physical
> and virtual makes no sense for them).  Some people use virtual machines
> as sandboxes, and want to burn the ISOs from the same VMs where they
> download the ISOs.  Some people have vendor utilities that only run
> under Windows, and want to run them in a VM.

So is this hypothetical or do you have a real customer in mind?  If
it's not theoretical, how does the cloud service control who has
access to the CD burner, and how are the disks loaded into the CD
burner?  Trying to do it where you run cdrecord from the guest OS
sounds **insane**.  The far better way of doing things is to export a
web service where you ship a iso image plus a shipping address to a
burn service, and you don't try to figure out how to make dozens of VM
on a cloud server share a physical CD burner attached to a physical
host OS.  That way leads to insanity.

						- Ted
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@...r.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/