[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH 05/16] xen: defer call to xen_restrict until jus
From: |
Anthony PERARD |
Subject: |
Re: [Qemu-devel] [PATCH 05/16] xen: defer call to xen_restrict until just before os_setup_post |
Date: |
Mon, 23 Apr 2018 15:28:22 +0100 |
User-agent: |
Mutt/1.9.5 (2018-04-13) |
On Thu, Apr 19, 2018 at 05:45:08PM +0100, Ian Jackson wrote:
> We need to restrict *all* the control fds that qemu opens. Looking in
> /proc/PID/fd shows there are many; their allocation seems scattered
> throughout Xen support code in qemu.
>
> We must postpone the restrict call until roughly the same time as qemu
> changes its uid, chroots (if applicable), and so on.
>
> There doesn't seem to be an appropriate hook already. The RunState
> change hook fires at different times depending on exactly what mode
> qemu is operating in.
>
> And it appears that no-one but the Xen code wants a hook at this phase
> of execution. So, introduce a bare call to a new function
> xen_setup_post, just before os_setup_post. Also provide the
> appropriate stub for when Xen compilation is disabled.
>
> We do the restriction before rather than after os_setup_post, because
> xen_restrict may need to open /dev/null, and os_setup_post might have
> called chroot.
>
> Currently this does not work with migration, because when running as
> the Xen device model qemu needs to signal to the toolstack that it is
> ready. It currently does this using xenstore, and for incoming
> migration (but not for ordinary startup) that happens after
> os_setup_post.
>
> It is correct that this happens late: we want the incoming migration
> stream to be processed by a restricted qemu. The fix for this will be
> to do the startup notification a different way, without using
> xenstore. (QMP is probably a reasonable choice.)
>
> So for now this restriction feature cannot be used in conjunction with
> migration. (Note that this is not a regression in this patch, because
> previously the -xen-restrict-domid call was, in fact, simply
> ineffective!) We will revisit this in the Xen 4.11 release cycle.
>
> Signed-off-by: Ian Jackson <address@hidden>
Acked-by: Anthony PERARD <address@hidden>
--
Anthony PERARD
- [Qemu-devel] [PATCH v7 00/16] xen: xen-domid-restrict improvements, Ian Jackson, 2018/04/19
- [Qemu-devel] [PATCH 01/16] checkpatch: Add xendevicemodel_handle to the list of types, Ian Jackson, 2018/04/19
- [Qemu-devel] [PATCH 03/16] xen: link against xentoolcore, Ian Jackson, 2018/04/19
- [Qemu-devel] [PATCH 06/16] xen: destroy_hvm_domain: Move reason into a variable, Ian Jackson, 2018/04/19
- [Qemu-devel] [PATCH 08/16] xen: destroy_hvm_domain: Try xendevicemodel_shutdown, Ian Jackson, 2018/04/19
- [Qemu-devel] [PATCH 13/16] xen: Expect xenstore write to fail when restricted, Ian Jackson, 2018/04/19
- [Qemu-devel] [PATCH 05/16] xen: defer call to xen_restrict until just before os_setup_post, Ian Jackson, 2018/04/19
- [Qemu-devel] [PATCH 04/16] xen: restrict: use xentoolcore_restrict_all, Ian Jackson, 2018/04/19
- [Qemu-devel] [PATCH 07/16] xen: move xc_interface compatibility fallback further up the file, Ian Jackson, 2018/04/19
- [Qemu-devel] [PATCH 09/16] os-posix: cleanup: Replace fprintfs with error_report in change_process_uid, Ian Jackson, 2018/04/19
- [Qemu-devel] [PATCH 14/16] os-posix: cleanup: Replace fprintf with error_report in remaining call sites, Ian Jackson, 2018/04/19
- [Qemu-devel] [PATCH 10/16] os-posix: Provide new -runas <uid>:<gid> facility, Ian Jackson, 2018/04/19