Bug 1043953

Summary:	virt-manager: local users can use VNC, SPICE connections of other users
Product:	Red Hat Enterprise Linux 6	Reporter:	Florian Weimer <fweimer>
Component:	virt-manager	Assignee:	Giuseppe Scrivano <gscrivan>
Status:	CLOSED WONTFIX	QA Contact:	Virtualization Bugs <virt-bugs>
Severity:	unspecified	Docs Contact:
Priority:	unspecified
Version:	6.4	CC:	acathrow, berrange, crobinso, dallan, virt-maint
Target Milestone:	rc
Target Release:	---
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:	1043919
Clones:	1044570 (view as bug list)		Environment:
Last Closed:	2014-02-06 13:31:08 UTC	Type:	Bug
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Bug Depends On:	1043919
Bug Blocks:

Description Florian Weimer 2013-12-17 13:48:49 UTC

I verified a while ago that this bug is also present in RHEL 6.4.

+++ This bug was initially created as a clone of Bug #1043919 +++

virt-manager does not prevent other local users from using the VNC and SPICE protocols to access the console of virtual machines created using virt-manager.

Using UNIX domain socket connections by default would be the best solution for this.  Automatically generated random passwords do not authenticate the server and allow it to be impersonated by other users because it is usually running on an untrusted port.

Comment 1 Giuseppe Scrivano 2014-02-06 13:31:08 UTC

this is not yet upstream and it is very unlikely that is going to happen for rhel-6.x, so I am going to close it as WONTFIX.  Please re-open if you disagree.