From mboxrd@z Thu Jan 1 00:00:00 1970 From: Vincent Hanquez Subject: Re: [PATCH] xenstored: allow guests to reintroduce themselves Date: Tue, 9 Aug 2011 13:33:21 +0100 Message-ID: <4E412911.4020306@eu.citrix.com> References: Mime-Version: 1.0 Content-Type: text/plain; charset="ISO-8859-1"; format=flowed Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Sender: xen-devel-bounces@lists.xensource.com Errors-To: xen-devel-bounces@lists.xensource.com To: Keir Fraser Cc: "xen-devel@lists.xensource.com" List-Id: xen-devel@lists.xenproject.org On 08/09/2011 12:31 PM, Keir Fraser wrote: > Do you have any examples of projects which could run with much lesser > privilege, and very constrained xenstore access, if a suitably controlled > xenstore interface was provided? There's a bunch of program that doesn't need much more than read/write to a specific limited part of xenstore. - Guest agents (reporting stats usually) - things listening to some actions (snapshot yourself, export some storage thing, etc..) Perhaps a variant of the restrict packet would be enough to drop some privileges of the xenbus connection (at connection time) to read/write to a specific path. -- Vincent