Re: [Xen-devel] [PATCH] libxl: create backend/ xenstore dir for driver domains

[Marek Marczykowski-Górecki <marmarek@xxxxxxxxxxxxxxxxxxxxxx>]

On Mon, Jan 06, 2020 at 02:20:46PM +0000, Ian Jackson wrote:
> Marek Marczykowski-Górecki writes ("[PATCH] libxl: create backend/ xenstore 
> dir for driver domains"):
> > Cleaning up backend xenstore entries is a responsibility of the backend.
> > When backend lives outside of dom0, the domain needs proper permissions
> > to do it. Normally it is given permission to remove the device dir
> > itself, but not the dir containing it (named after frontend ID). After a
> > whole those empty leftover directories accumulate to the point xenstore
> > returning E2BIG on listing them.
> > 
> > Fix this by giving backend domain write access also to backend/
> > directory itself when c_info->driver_domain option is set. The code
> > removing relevant dir is already there (just lacked permissions to do so).
> > 
> > Note this also allows the backend domain to create new entries,
> > pretending to host backend devices it don't have. But since libxl uses
> > /libxl/ xenstore dir for this information (still outside of backend
> > domain control), this shouldn't be an issue.
> 
> This seems quite hazardous to me.  The reasoning you use to show that
> this iws OK seems fragile, and in general it doesn't feel right to
> give the particular backend such wide scope.
> 
> Can we find another way to address this problem ?  I think the
> containing directory should be removed by the toolstack.  Why is this
> difficult ?  (I presume there is a reason or you would have done it
> that way...)

It was done this way previously and caused issues, see this commit:

commit 546678c6a60f64fb186640460dfa69a837c8fba5
Author: Roger Pau Monne <roger.pau@xxxxxxxxxx>
Date:   Wed Sep 23 12:06:56 2015 +0200

    libxl: fix the cleanup of the backend path when using driver domains
    
    With the current libxl implementation the control domain will remove both
    the frontend and the backend xenstore paths of a device that's handled by a
    driver domain. This is incorrect, since the driver domain possibly needs to
    access the backend path in order to perform the disconnection and cleanup of
    the device.
    
    Fix this by making sure the control domain only cleans the frontend path,
    leaving the backend path to be cleaned by the driver domain. Note that if
    the device is not handled by a driver domain the control domain will perform
    the removal of both the frontend and the backend paths.
    
    Signed-off-by: Roger Pau Monné <roger.pau@xxxxxxxxxx>
    Acked-by: Ian Jackson <ian.jackson@xxxxxxxxxxxxx>
    Reported-by: Alex Velazquez <alex.j.velazquez@xxxxxxxxx>
    Cc: Alex Velazquez <alex.j.velazquez@xxxxxxxxx>
    Cc: Ian Jackson <ian.jackson@xxxxxxxxxxxxx>
    Cc: Ian Campbell <ian.campbell@xxxxxxxxxx>
    Cc: Wei Liu <wei.liu2@xxxxxxxxxx>
    Acked-by: Ian Campbell <ian.campbell@xxxxxxxxxx>


-- 
Best Regards,
Marek Marczykowski-Górecki
Invisible Things Lab
A: Because it messes up the order in which people normally read text.
Q: Why is top-posting such a bad thing?

Attachment: signature.asc
Description: PGP signature

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel