[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Qemu-devel] [PATCH 0/5] ATAPI pass through v2

From: Anthony Liguori
Subject: Re: [Qemu-devel] [PATCH 0/5] ATAPI pass through v2
Date: Wed, 08 Jul 2009 13:03:03 -0500
User-agent: Thunderbird (X11/20090320)

Carl-Daniel Hailfinger wrote:
On 08.07.2009 18:38, Avi Kivity wrote:
On 07/08/2009 07:09 PM, Ian Jackson wrote:
I'm sure something like SELinux can be used to prevent a root QEMU
process from doing a firmware upgrade.
*boggle* You're not serious, are you ?
selinux can prevent anything.  In fact, I'm sure it does.

I doubt SELinux has a builtin ATAPI command filter which knows all
_undocumented_ firmware upgrade commands. In fact, there are some ATAPI
devices which abuse existing and documented-as-harmless ATAPI commands
(which are regularly used for CD burning) for firmware upgrades.

So then we can't prevent it either which means the whole discussion is moot :-)


Anthony Liguori

reply via email to

[Prev in Thread] Current Thread [Next in Thread]