Re: [Xen-devel] [PATCH RFC 1/2] libxl: allow /local/domain/0/device-model/$DOMID to be written by $DOMID

[Wei Liu <wei.liu2@xxxxxxxxxx>]

On Thu, Jun 04, 2015 at 11:06:39AM +0100, Stefano Stabellini wrote:
> On Tue, 2 Jun 2015, Wei Liu wrote:
> > On Mon, Jun 01, 2015 at 05:01:34PM +0100, Stefano Stabellini wrote:
> > > The device model is going to restrict its xenstore connection to $DOMID
> > > level. Let it access /local/domain/0/device-model/$DOMID, as it is
> > > required by QEMU to read/write the physmap. It doesn't contain any
> > > information the guest is not already fully aware of.
> > > 
> > > Signed-off-by: Stefano Stabellini <stefano.stabellini@xxxxxxxxxxxxx>
> > > ---
> > >  tools/libxl/libxl_dm.c |    7 ++++++-
> > >  1 file changed, 6 insertions(+), 1 deletion(-)
> > > 
> > > diff --git a/tools/libxl/libxl_dm.c b/tools/libxl/libxl_dm.c
> > > index 97a921f..e74042b 100644
> > > --- a/tools/libxl/libxl_dm.c
> > > +++ b/tools/libxl/libxl_dm.c
> > > @@ -1467,6 +1467,7 @@ void libxl__spawn_local_dm(libxl__egc *egc, 
> > > libxl__dm_spawn_state *dmss)
> > >      char **pass_stuff;
> > >      const char *dm;
> > >      int dm_state_fd = -1;
> > > +    struct xs_permissions rwperm[2];
> > >  
> > >      if (libxl_defbool_val(b_info->device_model_stubdomain)) {
> > >          abort();
> > > @@ -1509,7 +1510,11 @@ void libxl__spawn_local_dm(libxl__egc *egc, 
> > > libxl__dm_spawn_state *dmss)
> > >      }
> > >  
> > >      path = libxl__device_model_xs_path(gc, LIBXL_TOOLSTACK_DOMID, domid, 
> > > "");
> > > -    xs_mkdir(ctx->xsh, XBT_NULL, path);
> > > +    rwperm[0].id = 0;
> > 
> > Use LIBXL_TOOLSTACK_DOMID?
> 
> OK
> 
> 
> > > +    rwperm[0].perms = XS_PERM_WRITE;
> > 
> > This is probably not what you mean. This means all other domains have
> > write access.  See tools/xenstore/include/xenstore.h L152.
> 
> Right! I'll fix.
> 
> 
> > And, do you also want to consider stubdom?
> 
> I don't think there is much to do for stubdoms here: they are
> unaffected.
> 

Oh right, this is the local_dm spawn function. Sorry for the noise.

Wei.

> 
> > 
> > > +    rwperm[1].id = domid;
> > > +    rwperm[1].perms = XS_PERM_WRITE;
> > > +    libxl__xs_mkdir(gc, XBT_NULL, path, rwperm, 2); 
> > >  
> > >      if (b_info->type == LIBXL_DOMAIN_TYPE_HVM &&
> > >          b_info->device_model_version
> > > -- 
> > > 1.7.10.4
> > 

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel