mirror of
https://github.com/xen-project/xen.git
synced 2026-10-29 10:40:03 +01:00
Edwin Török
49ed711a95
Currently, oxenstored checks the length of paths against 1024, then prepends "/local/domain/$DOMID/" to relative paths. This allows a domU to create paths which can't subsequently be read by anyone, even dom0. This also interferes with listing directories, etc. Define a new oxenstored.conf entry: quota-path-max, defaulting to 1024 as before. For paths that begin with "/local/domain/$DOMID/" check the relative path length against this quota. For all other paths check the entire path length. This ensures that if the domid changes (and thus the length of a prefix changes) a path that used to be valid stays valid (e.g. after a live-migration). It also ensures that regardless how the client tries to access a path (domid-relative or absolute) it will get consistent results, since the limit is always applied on the final canonicalized path. Delete the unused Domain.get_path to avoid it being confused with Connection.get_path (which differs by a trailing slash only). Rewrite Util.path_validate to apply the appropriate length restriction based on whether the path is relative or not. Remove the check for connection_path being absolute, because it is not guest controlled data. This is part of XSA-323. Signed-off-by: Andrew Cooper <andrew.cooper3@citrix.com> Signed-off-by: Edwin Török <edvin.torok@citrix.com> Acked-by: Christian Lindig <christian.lindig@citrix.com>