From nobody Tue May 21 23:51:12 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) client-ip=192.237.175.120; envelope-from=xen-devel-bounces@lists.xenproject.org; helo=lists.xenproject.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass(p=quarantine dis=none) header.from=suse.com ARC-Seal: i=1; a=rsa-sha256; t=1675954179; cv=none; d=zohomail.com; s=zohoarc; b=kRRUHU7xxXd4L/uA4vR0+b6Rbv1gA0z00grSnMfA+WgkmfKs7m9OdmMEeoO72k8Lqqg4LQAj1kznXz6lUye01Uf5dr/EN1wE7zvyxPorCChNhzI9e3qzbtF2o0qmPhHJ9oJHooHjczDqPTFVmzZrolymVtav1GtNtlVwOudmfGs= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1675954179; h=Content-Transfer-Encoding:Cc:Date:From:List-Subscribe:List-Post:List-Id:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Sender:Subject:To; bh=YjnpbWlmXohZDrED88H73FNHl2lxTAanQxhg+wPy9ao=; b=A5QPb89EfGjhJ6c5KWLNJtAiZYniQmZAOeGndU7u9PrVIgp2gs5qic7u0dM2h+EZJ7nhmKrIrIJ7YGbKVZX5KpMRFpvVJK/CvC0n+m1cPNOC7q/hofo29Ee/Cj9DdfU/Jh7iizofokg9wLhDZNqWojUwJtio4lzWizUNSJke88I= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.xenproject.org designates 192.237.175.120 as permitted sender) smtp.mailfrom=xen-devel-bounces@lists.xenproject.org; dmarc=pass header.from= (p=quarantine dis=none) Return-Path: Received: from lists.xenproject.org (lists.xenproject.org [192.237.175.120]) by mx.zohomail.com with SMTPS id 1675954179328924.5252252646156; Thu, 9 Feb 2023 06:49:39 -0800 (PST) Received: from list by lists.xenproject.org with outflank-mailman.492538.762127 (Exim 4.92) (envelope-from ) id 1pQ8EL-0005qF-6B; Thu, 09 Feb 2023 14:48:57 +0000 Received: by outflank-mailman (output) from mailman id 492538.762127; Thu, 09 Feb 2023 14:48:57 +0000 Received: from localhost ([127.0.0.1] helo=lists.xenproject.org) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1pQ8EL-0005q8-1J; Thu, 09 Feb 2023 14:48:57 +0000 Received: by outflank-mailman (input) for mailman id 492538; Thu, 09 Feb 2023 14:48:55 +0000 Received: from se1-gles-flk1-in.inumbo.com ([94.247.172.50] helo=se1-gles-flk1.inumbo.com) by lists.xenproject.org with esmtp (Exim 4.92) (envelope-from ) id 1pQ8EJ-0005q0-TN for xen-devel@lists.xenproject.org; Thu, 09 Feb 2023 14:48:55 +0000 Received: from smtp-out1.suse.de (smtp-out1.suse.de [195.135.220.28]) by se1-gles-flk1.inumbo.com (Halon) with ESMTPS id dd4ea7e8-a888-11ed-93b5-47a8fe42b414; Thu, 09 Feb 2023 15:48:50 +0100 (CET) Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by smtp-out1.suse.de (Postfix) with ESMTPS id B68B833D84; Thu, 9 Feb 2023 14:48:49 +0000 (UTC) Received: from imap2.suse-dmz.suse.de (imap2.suse-dmz.suse.de [192.168.254.74]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (P-521) server-digest SHA512) (No client certificate requested) by imap2.suse-dmz.suse.de (Postfix) with ESMTPS id 7E0D5138E4; Thu, 9 Feb 2023 14:48:49 +0000 (UTC) Received: from dovecot-director2.suse.de ([192.168.254.65]) by imap2.suse-dmz.suse.de with ESMTPSA id 4WuNHdEH5WOUIQAAMHmgww (envelope-from ); Thu, 09 Feb 2023 14:48:49 +0000 X-Outflank-Mailman: Message body and most headers restored to incoming version X-BeenThere: xen-devel@lists.xenproject.org List-Id: Xen developer discussion List-Unsubscribe: , List-Post: List-Help: List-Subscribe: , Errors-To: xen-devel-bounces@lists.xenproject.org Precedence: list Sender: "Xen-devel" X-Inumbo-ID: dd4ea7e8-a888-11ed-93b5-47a8fe42b414 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=suse.com; s=susede1; t=1675954129; h=from:from:reply-to:date:date:message-id:message-id:to:to:cc:cc: mime-version:mime-version: content-transfer-encoding:content-transfer-encoding; bh=YjnpbWlmXohZDrED88H73FNHl2lxTAanQxhg+wPy9ao=; b=flUWnbOojtD+1k4RLXKRfdwpPfhfAd07cMb9StAj8t6A65Qp3FKQZuzHFll8SUbrN9dfUG 018xslWP5gQXtF0YIggHBlTxBjduw7QARas+dyDpaecl10sIA+ClPh5VOwjdvDnim2sCsz AjeVGtDgPnRtBafjvAKsP4J33XiTmg4= From: Juergen Gross To: xen-devel@lists.xenproject.org Cc: Juergen Gross , Andrew Cooper , George Dunlap , Jan Beulich , Julien Grall , Stefano Stabellini , Wei Liu Subject: [PATCH] docs: clarify xenstore permission documentation Date: Thu, 9 Feb 2023 15:41:48 +0100 Message-Id: <20230209144148.4132-1-jgross@suse.com> X-Mailer: git-send-email 2.35.3 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable X-ZohoMail-DKIM: pass (identity @suse.com) X-ZM-MESSAGEID: 1675954180786100001 Content-Type: text/plain; charset="utf-8" In docs/misc/xenstore.txt the description of the Xenstore node access permissions is missing one important aspect, which can be found only in the code or in the wiki [1]: The first permission entry is defining the owner of the node via the domid, and the access rights for all domains NOT having a dedicated permission entry. Make that aspect clear in the official documentation. [1]: https://wiki.xenproject.org/wiki/XenBus#Permissions Signed-off-by: Juergen Gross Reviewed-by: Julien Grall --- docs/misc/xenstore.txt | 17 ++++++++++------- 1 file changed, 10 insertions(+), 7 deletions(-) diff --git a/docs/misc/xenstore.txt b/docs/misc/xenstore.txt index 8887e7df88..d807ef0709 100644 --- a/docs/misc/xenstore.txt +++ b/docs/misc/xenstore.txt @@ -45,13 +45,16 @@ them to within 2048 bytes. (See XENSTORE_*_PATH_MAX in= xs_wire.h.) =20 Each node has one or multiple permission entries. Permissions are granted by domain-id, the first permission entry of each node specifies -the owner of the node. Permissions of a node can be changed by the -owner of the node, the owner can only be modified by the control -domain (usually domain id 0). The owner always has the right to read -and write the node, while other permissions can be setup to allow -read and/or write access. When a domain is being removed from Xenstore -nodes owned by that domain will be removed together with all of those -nodes' children. +the owner of the node, who always has full access to the node (read and +write permission). The access rights of the first entry specify the +allowed access for all domains not having a dedicated permission entry +(the default is "n", removing access for all domains not explicitly +added via additional permission entries). Permissions of a node can be +changed by the owner of the node, the owner can only be modified by the +control domain (usually domain id 0). Other permissions can be setup to +allow read and/or write access for other domains. When a domain is +being removed from Xenstore nodes owned by that domain will be removed +together with all of those nodes' children. =20 =20 Communication with xenstore is via either sockets, or event channel --=20 2.35.3