mirror of
https://github.com/xen-project/xen.git
synced 2026-10-28 10:11:27 +01:00
Ian Jackson
9f72a8647b
We want to stop libxl trustingly reading information from the backend directory (since this is, of course, writeable by the backend, which might be a semi-trusted driver domain). In principle it is wrong in current libxl for anything to try to divine virtual device configuration from xenstore: the JSON domain config ought to supply that, and xenstore should only tell us which devices actually exist. However: Firstly, there are several existing places where configuration information is retrieved from xenstore rather than JSON. We do not want to reen gineer this in a security patch. Secondly, we want to make a security patch which can be backported to versions of libxl without the JSON configuration machinery. So we take the expedient approach of keeping a copy of the configuration somewhere we trust, namely /libxl. This is obviously fairly low-risk, although it does write significantly more keys in xenstore. In this patch we make this change in libxl__device_generic_add. This is responsible for actually writing the vast majority of device information to xenstore. There are a few loose ends which will be dealt with in a moment. Likewise, changes to readers to use the new location will appear in further patches. This is part of XSA-178. Signed-off-by: Ian Jackson <Ian.Jackson@eu.citrix.com> Reviewed-by: Wei Liu <wei.liu2@citrix.com>
xen-bugtool =========== The xen-bugtool command line application will collate the Xen dmesg output, details of the hardware configuration of your machine, information about the build of Xen that you are using, plus, if you allow it, various logs. The information collated can either be posted to a Xen Bugzilla bug (this bug must already exist in the system, and you must be a registered user there), or it can be saved as a .tar.bz2 for sending or archiving. The collated logs may contain private information, and if you are at all worried about that, you should not use this tool, or you should explicitly exclude those logs from the archive. xen-bugtool is wholly interactive, so simply run it, and answer the questions.