TCP/vsock sockets allow a user to DoS a ACON TD belonging to a different user about acon

[xxu36]

@binxing Hi Cedric, I agree that the TCP port or Vsock are open so another user can utilize that to talk to acond. Of course, acond has many verification steps to possibly detect it, but this is still a possible DoS attack.

However, as for totally shutting down the VM, a user other than the one created the VM is not able to kill the VM. In the code of aconcli, VM shut down logic is currently implemented by sending the SIGTERM signal to the VM process. So if the user attempting to kill the VM is not the one who created it, he is not permitted to shutdown the VM or even list the status of this VM.

I did an experiment trying to shutdown a VM created by xiangquan:
[sgx@sgx-emr01 xxu36]$ ./aconcli shutdown -f tcp://:1025
Shutdown: cannot get VM pid for tcp://:1025: get pid for (tcp://:1025): cannot get matching pid
Similar result as trying to kill the VM process directly by kill command
[sgx@sgx-emr01 xxu36]$ kill -TERM 1383098
-bash: kill: (1383098) - Operation not permitted

[binxing]

@xxu36 You are right that an unauthorized user cannot kill the QEMU process, but he/she can stop containers, and after all containers are stopped, acond will time out and shut down QEMU.

Anyway, by forwarding host UNIX socket to guest TCP port, we can solve this problem cleanly.

I'm not sure how acond can tell who the user is. It will be able to authenticate the user with OpenID, but not before it is implemented.

[binxing]

QEMU doesn't look like supporting this option. Let's delay the fix until we have OpenID authentication.

[binxing]

This issue has been addressed by OpenID authentication added in v0.2.0.