the guest but deleted by dom0 were remaining accounted against the guest,
which meant that the guest would eventually run out of quota.
This patch also prevents unprivileged domains from changing the owner of a
node. One guest could attack another by creating nodes and then transferring
them to the ownership of another, and though the accounting could be made to
work properly in this case, domains should never be transferring nodes in any
case, so it seems safer just to disallow the operation entirely.
Signed-off-by: Ewan Mellor <ewan@xensource.com>
In certain cases, when a client doesn't have enough permissions, the
errno variable is not set in xenstored_core.c before its value is
reported back. As a result, the client can learn about the errno of
the last failed request to xenstored (which could have come from
another client). (An unintended information channel! :-)
From: Magnus Carlsson <magnus@galois.com>
Signed-off-by: Keir Fraser <keir@xensource.com>
since both xend and the xenstore-* utilities used in the hotplug
scripts can easily reach the limit and we trust them anyway.
Signed-off-by: Christian Limpach <Christian.Limpach@xensource.com>
the sources under the tools directory. This patch became necessary
after qemu-dm is updated to a newer version.
Signed-off-by: Hiroya INAKOSHI <inakoshi.hiroya@jp.fujitsu.com>
This utility permits developers and administrators to
manually change the permissions on arbitrary locations in XenStore
from the command line. This is often helpful if you're trying to debug an
application that relies on XenStore and is encountering difficulties
with permissions.
Signed-off-by: Michael LeMay <mdlemay@epoch.ncsc.mil>
browsing the list of transaction each time
Bump the default to 10, and make it configurable through the command line.
Signed-off-by: Vincent Hanquez <vincent@xensource.com>
some
long ago accidents of implementation in historical Unixes. And there
are various tools which "expect" it (... and this is why they get
created as executable by default by ld).
Switching to INSTALL_LIB here although I think the whole "define all
the
ways you're going to use install" in this makefile a _smidge_ overkill
Signed-off-by: Jeremy Katz <katzj@redhat.com>
No longer open the device as non-blocking: all reads immediately follow
a select() on the device indicating it's ready to read.
Signed-off-by: John Levon <john.levon@sun.com>
functions are checked to avoid some bugs, a few warnings pop up and
become errors due to -Werror. Attached checks the return codes
(or at least stores them to a dummy variable).
Signed-off-by: Jeremy Katz <katzj@redhat.com>
* Move .PHONY directives next to targets,
this makes them a lot harder to miss
* Add missing .PHONY directives
* Remove nonexistent .PHONY directives
* Hopefully I didn'T miss anything...
Signed-Off-By: Horms <horms@verge.net.au>
us greater confidence that our talloc implementation is "known good". Remove
the OOM handling from consider_message: talloc_set_fail_handler is no longer
supported.
Signed-off-by: Ewan Mellor <ewan@xensource.com>
entries and for orphaned nodes in the database.
Added two flags, -R and -L, to disable the recovery code and the remove of
/local at start-up. This makes it much easier to analyse corrupted tdb files.
Added some missing talloc_free calls in the previous integrity checking code.
Removed the transaction handle from the trace_io message -- unfortunately,
the transaction is always null at this point, as it's not yet been looked up.
Signed-off-by: Ewan Mellor <ewan@xensource.com>
corruption, rather than just spewing error messages and exiting.
Added a xenstore-control executable, which sends commands to xenstored.
Currently, the only command is 'check', which triggers an integrity check.
(The integrity check is also triggered whenever a corrupted store is detected).
Signed-off-by: Ewan Mellor <ewan@xensource.com>
