Our company gives a VM for each developer which is exclusive for them but doesnt give root access.

I am planning to ask for root password so I can install different softwares on the VM.

Just want to make sure, having a root password on VM doesnt give me any control on the host system.


Nope. It shouldn't give you any host access, assuming you're on one of the major virtualization suites (VMWare, KVM, Xen, etc.).

  • 1
    Assuming the root-password is not the same for all machines (including real ones)...on the other side, you might need to kick the IT department if that's the case. – Bobby Sep 24 '12 at 15:02
  • 1
    Your answer is true in "normal" circumstances, but not when looking at exploits. So this is a matter of trust. – Nils Sep 25 '12 at 14:06

There have been security problems with VMWare,KVM and XEN in the past, where you could get root on the VM-server if you were root in the VM.

Update 1:

For this reason I understand the unwillingness to pass root-passwords even for VMs.

An example for XEN is CVE-2012-3515 (this looks harmless on the third glance).

An example for KVM is CVE-2011-2512.

An example for VMWare is CVE-2012-1518.

As there may be other unknown zero-day-exploits around one can never be sure...

Update 2:

root-access in XEN will give you control about xen-ram-ballooning, too. This might have some bad side-effects on the VM-server-side, too (I tested this on a XEN Dom0: there are cases where the Dom0 does not tell the admin the truth any longer about the memory-consumtion of the DomU).

  • That doesn't make any sense. If I have access to the virtual guest console, I can own the guest easily enough by changing the root password, same as with a physical machine. – Michael Hampton Sep 25 '12 at 13:59
  • @MichaelHampton even in XEN console access might not give you the right to change the root-password. If using pygrub a grub-password should be active... but as I wrote this XEN-CVE looks harmless on the third glance. But it shows that there are exploits out there no normal user and admin can imagine. – Nils Sep 25 '12 at 14:10
  • And that's why we use sVirt. – Michael Hampton Sep 25 '12 at 15:02
  • @MichaelHampton Are you sure that SELinux would have helped against CVE-2012-0029? – Nils Sep 26 '12 at 14:28
  • This is getting lengthy. Feel free to drop into chat if you want to discuss it further. – Michael Hampton Sep 26 '12 at 14:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.