mirror of
https://github.com/xen-project/xen.git
synced 2026-10-28 10:11:27 +01:00
Juergen Gross
496306324d
Access rights of Xenstore nodes are per domid. Unfortunately existing granted access rights are not removed when a domain is being destroyed. This means that a new domain created with the same domid will inherit the access rights to Xenstore nodes from the previous domain(s) with the same domid. This can be avoided by adding a generation counter to each domain. The generation counter of the domain is set to the global generation counter when a domain structure is being allocated. When reading or writing a node all permissions of domains which are younger than the node itself are dropped. This is done by flagging the related entry as invalid in order to avoid modifying permissions in a way the user could detect. A special case has to be considered: for a new domain the first Xenstore entries are already written before the domain is officially introduced in Xenstore. In order not to drop the permissions for the new domain a domain struct is allocated even before introduction if the hypervisor is aware of the domain. This requires adding another bool "introduced" to struct domain in xenstored. In order to avoid additional padding holes convert the shutdown flag to bool, too. As verifying permissions has its price regarding runtime add a new quota for limiting the number of permissions an unprivileged domain can set for a node. The default for that new quota is 5. This is part of XSA-322. Signed-off-by: Juergen Gross <jgross@suse.com> Reviewed-by: Paul Durrant <paul@xen.org> Acked-by: Julien Grall <julien@amazon.com>
96 lines
3.0 KiB
C
96 lines
3.0 KiB
C
/*
|
|
Common routines between Xen store user library and daemon.
|
|
Copyright (C) 2005 Rusty Russell IBM Corporation
|
|
|
|
This library is free software; you can redistribute it and/or
|
|
modify it under the terms of the GNU Lesser General Public
|
|
License as published by the Free Software Foundation; either
|
|
version 2.1 of the License, or (at your option) any later version.
|
|
|
|
This library is distributed in the hope that it will be useful,
|
|
but WITHOUT ANY WARRANTY; without even the implied warranty of
|
|
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
|
|
Lesser General Public License for more details.
|
|
|
|
You should have received a copy of the GNU Lesser General Public
|
|
License along with this library; If not, see <http://www.gnu.org/licenses/>.
|
|
*/
|
|
|
|
#ifndef XENSTORE_LIB_H
|
|
#define XENSTORE_LIB_H
|
|
|
|
#include <stddef.h>
|
|
#include <stdbool.h>
|
|
#include <limits.h>
|
|
#include <errno.h>
|
|
#include <stdint.h>
|
|
#include <xen/io/xs_wire.h>
|
|
|
|
/* Bitmask of permissions. */
|
|
enum xs_perm_type {
|
|
XS_PERM_NONE = 0,
|
|
XS_PERM_READ = 1,
|
|
XS_PERM_WRITE = 2,
|
|
/* Internal use. */
|
|
XS_PERM_ENOENT_OK = 4,
|
|
XS_PERM_OWNER = 8,
|
|
XS_PERM_IGNORE = 16,
|
|
};
|
|
|
|
struct xs_permissions
|
|
{
|
|
unsigned int id;
|
|
enum xs_perm_type perms;
|
|
};
|
|
|
|
/* Header of the node record in tdb. */
|
|
struct xs_tdb_record_hdr {
|
|
uint64_t generation;
|
|
uint32_t num_perms;
|
|
uint32_t datalen;
|
|
uint32_t childlen;
|
|
struct xs_permissions perms[0];
|
|
};
|
|
|
|
/* Each 10 bits takes ~ 3 digits, plus one, plus one for nul terminator. */
|
|
#define MAX_STRLEN(x) ((sizeof(x) * CHAR_BIT + CHAR_BIT-1) / 10 * 3 + 2)
|
|
|
|
/* Path for various daemon things: env vars can override. */
|
|
const char *xs_daemon_rootdir(void);
|
|
const char *xs_daemon_rundir(void);
|
|
const char *xs_daemon_socket(void);
|
|
const char *xs_daemon_socket_ro(void);
|
|
const char *xs_domain_dev(void);
|
|
const char *xs_daemon_tdb(void);
|
|
|
|
/* Simple write function: loops for you. */
|
|
bool xs_write_all(int fd, const void *data, unsigned int len);
|
|
|
|
/* Convert strings to permissions. False if a problem. */
|
|
bool xs_strings_to_perms(struct xs_permissions *perms, unsigned int num,
|
|
const char *strings);
|
|
|
|
/* Convert permissions to a string (up to len MAX_STRLEN(unsigned int)+1). */
|
|
bool xs_perm_to_string(const struct xs_permissions *perm,
|
|
char *buffer, size_t buf_len);
|
|
|
|
/* Given a string and a length, count how many strings (nul terms). */
|
|
unsigned int xs_count_strings(const char *strings, unsigned int len);
|
|
|
|
/* Sanitising (quoting) possibly-binary strings. */
|
|
struct expanding_buffer {
|
|
char *buf;
|
|
int avail;
|
|
};
|
|
|
|
/* Ensure that given expanding buffer has at least min_avail characters. */
|
|
char *expanding_buffer_ensure(struct expanding_buffer *, int min_avail);
|
|
|
|
/* sanitise_value() may return NULL if malloc fails. */
|
|
char *sanitise_value(struct expanding_buffer *, const char *val, unsigned len);
|
|
|
|
/* *out_len_r on entry is ignored; out must be at least strlen(in)+1 bytes. */
|
|
void unsanitise_value(char *out, unsigned *out_len_r, const char *in);
|
|
|
|
#endif /* XENSTORE_LIB_H */
|