tools/ocaml/xenstored: introduce permissions for special watches

The special watches "@introduceDomain" and "@releaseDomain" should be
allowed for privileged callers only, as they allow to gain information
about presence of other guests on the host. So send watch events for
those watches via privileged connections only.

Start to address this by treating the special watches as regular nodes
in the tree, which gives them normal semantics for permissions.  A later
change will restrict the handling, so that they can't be listed, etc.

This is part of XSA-115.

Signed-off-by: Edwin Török <edvin.torok@citrix.com>
Acked-by: Christian Lindig <christian.lindig@citrix.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>

diff --git a/tools/ocaml/xenstored/process.ml b/tools/ocaml/xenstored/process.ml
index f374abe99836a506b174e19d9240549cc186568c..c3c8ea2f4b6b641988ffa51c503509a48d26c9b5 100644 (file)
--- a/tools/ocaml/xenstored/process.ml
+++ b/tools/ocaml/xenstored/process.ml
@@ -414,7 +414,7 @@ let do_introduce con t domains cons data =
                else try
                        let ndom = Domains.create domains domid mfn port in
                        Connections.add_domain cons ndom;
-                       Connections.fire_spec_watches cons "@introduceDomain";
+                       Connections.fire_spec_watches cons Store.Path.introduce_domain;
                        ndom
                with _ -> raise Invalid_Cmd_Args
        in
@@ -433,7 +433,7 @@ let do_release con t domains cons data =
        Domains.del domains domid;
        Connections.del_domain cons domid;
        if fire_spec_watches 
-       then Connections.fire_spec_watches cons "@releaseDomain"
+       then Connections.fire_spec_watches cons Store.Path.release_domain
        else raise Invalid_Cmd_Args
 
 let do_resume con t domains cons data =

diff --git a/tools/ocaml/xenstored/store.ml b/tools/ocaml/xenstored/store.ml
index 6375a1c889913043ded6e52fcdc982d7f6627a8c..98d368d52fd5d4c3978907aeabd187fb6fdda1d1 100644 (file)
--- a/tools/ocaml/xenstored/store.ml
+++ b/tools/ocaml/xenstored/store.ml
@@ -214,6 +214,11 @@ let rec lookup node path fct =
 
 let apply rnode path fct =
        lookup rnode path fct
+
+let introduce_domain = "@introduceDomain"
+let release_domain = "@releaseDomain"
+let specials = List.map of_string [ introduce_domain; release_domain ]
+
 end
 
 (* The Store.t type *)

diff --git a/tools/ocaml/xenstored/utils.ml b/tools/ocaml/xenstored/utils.ml
index e89c1aff048d701603f7ad8ebc4d372c7cf36a59..f3d95e889760cf737e01a1625d7e6b2336f90701 100644 (file)
--- a/tools/ocaml/xenstored/utils.ml
+++ b/tools/ocaml/xenstored/utils.ml
@@ -89,19 +89,17 @@ let read_file_single_integer filename =
        Unix.close fd;
        int_of_string (String.sub buf 0 sz)
 
-let path_complete path connection_path =
-       if String.get path 0 <> '/' then
-               connection_path ^ path
-       else
-               path
-
+(* @path may be guest data and needs its length validating.  @connection_path
+ * is generated locally in xenstored and always of the form "/local/domain/$N/" *)
 let path_validate path connection_path =
-       if String.length path = 0 || String.length path > 1024 then
-               raise Define.Invalid_path
-       else
-               let cpath = path_complete path connection_path in
-               if String.get cpath 0 <> '/' then
-                       raise Define.Invalid_path
-               else
-                       cpath
+       let len = String.length path in
+
+       if len = 0 || len > 1024 then raise Define.Invalid_path;
+
+       let abs_path =
+               match String.get path 0 with
+               | '/' | '@' -> path
+               | _   -> connection_path ^ path
+       in
 
+       abs_path

diff --git a/tools/ocaml/xenstored/xenstored.ml b/tools/ocaml/xenstored/xenstored.ml
index 49fc18bf198f25c9c7f1471bdc67c37a558447a1..32c3b1c0f18f6e269b8e22750a9ed9fed4a777ae 100644 (file)
--- a/tools/ocaml/xenstored/xenstored.ml
+++ b/tools/ocaml/xenstored/xenstored.ml
@@ -287,6 +287,8 @@ let _ =
        let quit = ref false in
 
        Logging.init_xenstored_log();
+       List.iter (fun path ->
+               Store.write store Perms.Connection.full_rights path "") Store.Path.specials;
 
        let filename = Paths.xen_run_stored ^ "/db" in
        if cf.restart && Sys.file_exists filename then (
@@ -339,7 +341,7 @@ let _ =
                                        let (notify, deaddom) = Domains.cleanup domains in
                                        List.iter (Connections.del_domain cons) deaddom;
                                        if deaddom <> [] || notify then
-                                               Connections.fire_spec_watches cons "@releaseDomain"
+                                               Connections.fire_spec_watches cons Store.Path.release_domain
                                )
                                else
                                        let c = Connections.find_domain_by_port cons port in