mirror of
https://github.com/xen-project/xen.git
synced 2026-10-28 18:21:39 +01:00
Edwin Török
bf0703992c
Currently, oxenstored checks the length of paths against 1024, then prepends "/local/domain/$DOMID/" to relative paths. This allows a domU to create paths which can't subsequently be read by anyone, even dom0. This also interferes with listing directories, etc. Define a new oxenstored.conf entry: quota-path-max, defaulting to 1024 as before. For paths that begin with "/local/domain/$DOMID/" check the relative path length against this quota. For all other paths check the entire path length. This ensures that if the domid changes (and thus the length of a prefix changes) a path that used to be valid stays valid (e.g. after a live-migration). It also ensures that regardless how the client tries to access a path (domid-relative or absolute) it will get consistent results, since the limit is always applied on the final canonicalized path. Delete the unused Domain.get_path to avoid it being confused with Connection.get_path (which differs by a trailing slash only). Rewrite Util.path_validate to apply the appropriate length restriction based on whether the path is relative or not. Remove the check for connection_path being absolute, because it is not guest controlled data. This is part of XSA-323. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Signed-off-by: Edwin Török <edvin.torok@citrix.com> Acked-by: Christian Lindig <christian.lindig@citrix.com>
16 lines
410 B
OCaml
16 lines
410 B
OCaml
type pkt = {
|
|
tid : int;
|
|
rid : int;
|
|
ty : Op.operation;
|
|
len : int;
|
|
buf : Buffer.t;
|
|
}
|
|
external header_size : unit -> int = "stub_header_size"
|
|
external header_of_string_internal : string -> int * int * int * int
|
|
= "stub_header_of_string"
|
|
val xenstore_payload_max : int
|
|
val xenstore_rel_path_max : int
|
|
val of_string : string -> pkt
|
|
val append : pkt -> string -> int -> unit
|
|
val to_complete : pkt -> int
|