tools/xenstore: fix connection->id usage

Don't use conn->id for privilege checks, but domain_is_unprivileged().

This is part of XSA-326.

Signed-off-by: Juergen Gross <jgross@suse.com>
Reviewed-by: Julien Grall <jgrall@amazon.com>

diff --git a/tools/xenstore/xenstored_control.c b/tools/xenstore/xenstored_control.c
index f0e00db633ec43aaddd68aa9744a6f3aa1549057..61bcbc069d753a3216159d7e6e6446bfbf4d3745 100644 (file)
--- a/tools/xenstore/xenstored_control.c
+++ b/tools/xenstore/xenstored_control.c
@@ -878,7 +878,7 @@ int do_control(struct connection *conn, struct buffered_data *in)
        unsigned int cmd, num, off;
        char **vec = NULL;
 
-       if (conn->id != 0)
+       if (domain_is_unprivileged(conn))
                return EACCES;
 
        off = get_string(in, 0);

diff --git a/tools/xenstore/xenstored_core.h b/tools/xenstore/xenstored_core.h
index e1d47f88445f3cbf8f791e1f86b208307e830eb7..aa0dedde644bac65bef4139212a31f93e3560a15 100644 (file)
--- a/tools/xenstore/xenstored_core.h
+++ b/tools/xenstore/xenstored_core.h
@@ -123,7 +123,7 @@ struct connection
        /* The index of pollfd in global pollfd array */
        int pollfd_idx;
 
-       /* Who am I? 0 for socket connections. */
+       /* Who am I? Domid of connection. */
        unsigned int id;
 
        /* Is this connection ignored? */

diff --git a/tools/xenstore/xenstored_transaction.c b/tools/xenstore/xenstored_transaction.c
index 54432907fc76fe3d78ff0e0d1db797a4f703bb20..ee1b09031a3b4d6e820b15f25ccc54a68166f50c 100644 (file)
--- a/tools/xenstore/xenstored_transaction.c
+++ b/tools/xenstore/xenstored_transaction.c
@@ -477,7 +477,8 @@ int do_transaction_start(struct connection *conn, struct buffered_data *in)
        if (conn->transaction)
                return EBUSY;
 
-       if (conn->id && conn->transaction_started > quota_max_transaction)
+       if (domain_is_unprivileged(conn) &&
+           conn->transaction_started > quota_max_transaction)
                return ENOSPC;
 
        /* Attach transaction to input for autofree until it's complete */