Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Is anyone aware of a way to restrict usage of dom0 (i.e., the xm command) to a certain subset of commands? In my case I'd like to prevent the dom0 user from doing anything other than resuming a saved domU.

I'm guessing that since you need to be root to use the xm tool there's not much I can do to restrict powers. I'd love to hear any ideas on other ways of achieving my goal.

share|improve this question
add comment

1 Answer

up vote 2 down vote accepted

Without modifying xend to not support certain operations, you can't stop someone with access to the dom0 from starting new domUs, because someone who wanted to start a new domU could just issue API commands. Honestly, restricting xm commands is somewhat dangerous because there are ways that a domU can crash, and need to be restarted.

Also, if someone who can't be trusted not to start VMs at inappropriate moments has root on your dom0s, I really think your permissions priorities are drunkenly insane. Instead, consider restricting users who need to do these limited operations to a non-root user, and a sudo-enabled wrapper script provided to manipulate VM state in approved ways.

share|improve this answer
    
Thanks! I didn't know sudo-wrapped scripts existed and now I do. –  Soybean Dec 27 '09 at 18:48
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.