mirror of
https://github.com/xen-project/xen.git
synced 2026-10-28 10:11:27 +01:00
George Dunlap
f45e7d333f
Untrusted device models must be killed by uid rather than by pid for safety. To do this reliably, we need another uid, not used for any other purpose, from which to make the kill system call. When using xen-qemuuser-range-base, we can repurpose xen-qemuuser-range-base itself as a UID from which to kill other devicemodel uids (since domain ID 0 should never have a device model associated with it). However, we'd like people to be able to use the device_model_user feature without also defining xen-qemuuser-range-base (which requires the ability to 'reserve' 32k+ user IDs). To that end, introduce the xen-qemuuser-reaper id. When killing by UID, first look for and use that ID if available; then fall back to xen-qemuuser-range-base. Document the new call in docs/features/qemu-deprivilege.pandoc. Signed-off-by: George Dunlap <george.dunlap@citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com>