[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] Re: [Xen-devel] [PATCH RFC 1/2] libxl: allow /local/domain/0/device-model/$DOMID to be written by $DOMID
On Tue, 2 Jun 2015, Wei Liu wrote: > On Mon, Jun 01, 2015 at 05:01:34PM +0100, Stefano Stabellini wrote: > > The device model is going to restrict its xenstore connection to $DOMID > > level. Let it access /local/domain/0/device-model/$DOMID, as it is > > required by QEMU to read/write the physmap. It doesn't contain any > > information the guest is not already fully aware of. > > > > Signed-off-by: Stefano Stabellini <stefano.stabellini@xxxxxxxxxxxxx> > > --- > > tools/libxl/libxl_dm.c | 7 ++++++- > > 1 file changed, 6 insertions(+), 1 deletion(-) > > > > diff --git a/tools/libxl/libxl_dm.c b/tools/libxl/libxl_dm.c > > index 97a921f..e74042b 100644 > > --- a/tools/libxl/libxl_dm.c > > +++ b/tools/libxl/libxl_dm.c > > @@ -1467,6 +1467,7 @@ void libxl__spawn_local_dm(libxl__egc *egc, > > libxl__dm_spawn_state *dmss) > > char **pass_stuff; > > const char *dm; > > int dm_state_fd = -1; > > + struct xs_permissions rwperm[2]; > > > > if (libxl_defbool_val(b_info->device_model_stubdomain)) { > > abort(); > > @@ -1509,7 +1510,11 @@ void libxl__spawn_local_dm(libxl__egc *egc, > > libxl__dm_spawn_state *dmss) > > } > > > > path = libxl__device_model_xs_path(gc, LIBXL_TOOLSTACK_DOMID, domid, > > ""); > > - xs_mkdir(ctx->xsh, XBT_NULL, path); > > + rwperm[0].id = 0; > > Use LIBXL_TOOLSTACK_DOMID? OK > > + rwperm[0].perms = XS_PERM_WRITE; > > This is probably not what you mean. This means all other domains have > write access. See tools/xenstore/include/xenstore.h L152. Right! I'll fix. > And, do you also want to consider stubdom? I don't think there is much to do for stubdoms here: they are unaffected. > > > + rwperm[1].id = domid; > > + rwperm[1].perms = XS_PERM_WRITE; > > + libxl__xs_mkdir(gc, XBT_NULL, path, rwperm, 2); > > > > if (b_info->type == LIBXL_DOMAIN_TYPE_HVM && > > b_info->device_model_version > > -- > > 1.7.10.4 > _______________________________________________ Xen-devel mailing list Xen-devel@xxxxxxxxxxxxx http://lists.xen.org/xen-devel
|
Lists.xenproject.org is hosted with RackSpace, monitoring our |