Bug 592382 - Small typo: xend mentioned instead of kvm in RHEL 6 beta Virtualization Guide
Small typo: xend mentioned instead of kvm in RHEL 6 beta Virtualization Guide
Status: CLOSED CURRENTRELEASE
Product: Red Hat Enterprise Linux 6
Classification: Red Hat
Component: doc-Virtualization_Administration_Guide (Show other bugs)
6.1
All Linux
low Severity medium
: rc
: ---
Assigned To: Christopher Curran
ecs-bugs
: Documentation
Depends On:
Blocks:
  Show dependency treegraph
 
Reported: 2010-05-14 13:46 EDT by Justin Clift
Modified: 2011-12-05 20:04 EST (History)
2 users (show)

See Also:
Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2010-08-31 00:23:30 EDT
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Justin Clift 2010-05-14 13:46:08 EDT
Description of problem:

"xend" is mentioned in the RHEL 6 beta (April 2010) Virtualization Guide where it should probably say KVM instead:

  http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6-Beta/html/Virtualization/sect-Virtualization-Troubleshooting_Xen-Troubleshooting_with_serial_consoles.html

  29.3. Troubleshooting with serial consoles
  "logging output with xend is unavailable"
Comment 2 Christopher Curran 2010-05-18 21:02:19 EDT
Fixed in build 21. This fix should be live soon.

Chris
Comment 3 Justin Clift 2010-05-21 06:52:16 EDT
Hi Chris,

Same problem here:

  http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6-Beta/html/Virtualization/chap-Virtualization-Security_for_virtualization.html

Mentions of Xen and dom0:

  The host, in the Xen hypervisor, is a privileged domain that handles system
  management and manages all virtual machines. If the host is insecure, all
  other domains in the system are vulnerable.

  + Use a firewall to restrict traffic to dom0. You can setup a firewall with
    default-reject rules that will help secure attacks on dom0. It is also
    important to limit network facing services.

  + Do not allow normal users to access dom0. If you do permit normal users dom0
    access, you run the risk of rendering dom0 vulnerable. Remember, dom0 is
    privileged, and granting unprivileged accounts may compromise the level of
    security. 

Do you want this filed as a separate bug, or is here ok?
Comment 4 Justin Clift 2010-05-21 07:04:00 EDT
Similar here:

  http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6-Beta/html/Virtualization/sect-Virtualization-Security_for_virtualization-SELinux_and_virtualization.html

  5. Set the correct SELinux type for the Xen folder.

     semanage fcontext -a -t xen_image_t "/virtualization(/.*)?"

     Alternatively, set the correct SELinux type for a KVM folder.

     semanage fcontext -a -t virt_image_t "/virtualization(/.*)?"


Is it worth swapping the Xen and KVM entries around, for first emphasis on KVM?
Comment 5 Justin Clift 2010-05-21 08:01:52 EDT
This looks like a carry over from RHEL 5 as well:

  http://www.redhat.com/docs/en-US/Red_Hat_Enterprise_Linux/6-Beta/html/Virtualization/sect-Virtualization-Security_for_virtualization-SELinux_considerations.html

  "The Boolean parameter xend_disable_t can set the xend to unconfined mode after restarting the daemon. It is better to disable protection for a single daemon than the whole system. It is advisable that you should not re-label directories as xen_image_t that you will use elsewhere."
Comment 6 RHEL Product and Program Management 2010-06-07 11:54:24 EDT
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux major release.  Product Management has requested further
review of this request by Red Hat Engineering, for potential inclusion in a Red
Hat Enterprise Linux Major release.  This request is not yet committed for
inclusion.

Note You need to log in before you can comment on or make changes to this bug.