mirror of
https://github.com/xen-project/xen.git
synced 2026-10-29 10:40:03 +01:00
George Dunlap
87f9458e34
Using kill(-1) to killing an untrusted dm process with the real uid equal to the dm_uid isn't guaranteed to succeed: the process in question may be able to kill the reaper process after the setresuid() and before the kill(). Instead, set the real uid to the QEMU user for domain 0 (QEMU_USER_RANGE_BASE + 0). The reaper process will still be able to kill the dm process, but not vice versa. This, in turn, requires locking to make sure that only one reaper process is using that uid at a time; otherwise one reaper process may kill the other reaper process. Create a lockfile in RUNDIR/dm-reaper-lock, and grab the lock before executing kill. In the event that we can't get the lock for some reason, go ahead with the kill using dm_uid for both real and effective UIDs. This isn't guaranteed to work, but it's no worse than not trying to kill the process at all. NB that this effectively requires admins using device_model_user to also define xen_qemuuser_range_base; this will be addressed in subsequent patches. Signed-off-by: George Dunlap <george.dunlap@citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>