diff options
| -rw-r--r-- | tools/ocaml/libs/xb/op.ml | 4 | ||||
| -rw-r--r-- | tools/xenstore/xs.c | 8 | ||||
| -rw-r--r-- | tools/xenstore/xs.h | 9 | ||||
| -rw-r--r-- | xen/include/public/io/xs_wire.h | 3 |
4 files changed, 21 insertions, 3 deletions
diff --git a/tools/ocaml/libs/xb/op.ml b/tools/ocaml/libs/xb/op.ml index 6ea8fe6d07..97e38f236e 100644 --- a/tools/ocaml/libs/xb/op.ml +++ b/tools/ocaml/libs/xb/op.ml @@ -31,13 +31,13 @@ let operation_c_mapping = Transaction_end; Introduce; Release; Getdomainpath; Write; Mkdir; Rm; Setperms; Watchevent; Error; Isintroduced; - Resume; Set_target |] + Resume; Set_target; Restrict |] let size = Array.length operation_c_mapping (* [offset_pq] has to be the same as in <xen/io/xs_wire.h> *) let offset_pq = size let operation_c_mapping_pq = - [| Restrict |] + [| |] let size_pq = Array.length operation_c_mapping_pq let array_search el a = diff --git a/tools/xenstore/xs.c b/tools/xenstore/xs.c index 094db25efa..3441656039 100644 --- a/tools/xenstore/xs.c +++ b/tools/xenstore/xs.c @@ -615,6 +615,14 @@ unwind: return false; } +bool xs_restrict(struct xs_handle *h, unsigned domid) +{ + char buf[16]; + + sprintf(buf, "%d", domid); + return xs_bool(xs_single(h, XBT_NULL, XS_RESTRICT, buf, NULL)); +} + /* Watch a node for changes (poll on fd to detect, or call read_watch()). * When the node (or any child) changes, fd will become readable. * Token is returned when watch is read, to allow matching. diff --git a/tools/xenstore/xs.h b/tools/xenstore/xs.h index 4dae5944ae..4806f1e240 100644 --- a/tools/xenstore/xs.h +++ b/tools/xenstore/xs.h @@ -83,6 +83,15 @@ bool xs_mkdir(struct xs_handle *h, xs_transaction_t t, bool xs_rm(struct xs_handle *h, xs_transaction_t t, const char *path); +/* Restrict a xenstore handle so that it acts as if it had the + * permissions of domain @domid. The handle must currently be + * using domain 0's credentials. + * + * Returns false on failure, in which case the handle continues + * to use the old credentials, or true on success. + */ +bool xs_restrict(struct xs_handle *h, unsigned domid); + /* Get permissions of node (first element is owner, first perms is "other"). * Returns malloced array, or NULL: call free() after use. */ diff --git a/xen/include/public/io/xs_wire.h b/xen/include/public/io/xs_wire.h index 24b5619fd8..e1debceb63 100644 --- a/xen/include/public/io/xs_wire.h +++ b/xen/include/public/io/xs_wire.h @@ -47,7 +47,8 @@ enum xsd_sockmsg_type XS_ERROR, XS_IS_DOMAIN_INTRODUCED, XS_RESUME, - XS_SET_TARGET + XS_SET_TARGET, + XS_RESTRICT }; #define XS_WRITE_NONE "NONE" |