72069d8526
filecopy: create new file unaccessible to the user until fully written
...
Otherwise source domain can modify (append) the file while the user
already is accessing it. While incoming files should be treated as
untrusted, this problem could allow file modification after the user
makes some sanity checks.
10 years ago
bc75b6559b
Use xenstore.h when xen >= 4.2
10 years ago
821a1c2fe9
qrexec-lib: use _exit in child process to not fire atexit hooks
...
Otherwise it would remove qrexec socket.
11 years ago
b8b4e105c0
qrexec-lib: return unsigned where only non-negative value is returned
11 years ago
b12f1539a4
Add -Wextra -Werror to all C code
...
Not only the security-critical one.
11 years ago
12a9049cfe
Fix some more -Wextra warnings
11 years ago
03c9cb1388
Add a few consts where appropriate
11 years ago
9f3a74fd77
unpack: prevent ability to bypass the byte limit
...
By passing an empty file with a declared negative size,
a hostile VM can decrease the total bytes counter, while
not have do supply a huge amount of data, thus disabing
the byte size check, and potentially filling the target
filesystem.
11 years ago
516815a266
qrexec-lib: make it shared library
11 years ago
113826aa1a
qrexec-lib: use registered callbacks
...
...instead of exported symbols of certain name. This is first step to
use change it to shared libraries.
11 years ago
1c6f44d7fa
qrexec-lib: fix compile warnings
11 years ago
f7e943f7ec
txrx-vchan: guard against invalid buffer sizes from libvchan
...
These APIs can now return -1 when invalid indices are detected.
11 years ago
e36f03db2d
unix-server: do not check for unlink() error when creating socket
...
The socket most likely do not exists yet.
11 years ago
a2e4f9a8aa
ioall: do not reset file flags when they're already as requested
...
This was changed on a copy of that file elsewhere, might as well
keep this in sync too.
11 years ago
3a39c65e3e
linux-utils: misc const/prototype fixups
11 years ago
af78e8d9e8
unpack: count directory and symlink sizes
...
Also do not rely on unpack being called just once if we don't
have to and initialize counts.
Since we don't know directory size before populating with files,
we just accumulate the size on the second pass, but do not actually
check for the limit being reached. If there's any file after that,
that'll trip the check.
11 years ago
77d34c3096
unix-server: guard against buffer overflow
...
sun_path is fairly small, and while the input is a smaller constant,
you never know how that might change.
11 years ago
21154a3e6b
unix-server: some error checking
11 years ago
9192aa041d
buffer.c: guard against bad input
...
The byte limit would be hit if adding one byte to a buffer
that's half the limit, due to the temporary double copy.
Not sure if that's something that's worth changing.
11 years ago
21612bfadf
qrexec-lib: add support for verbose mode (echo just processed file)
11 years ago
761305bc8b
qrexec-lib: check files limit before processing the file
...
Off-by-one error.
11 years ago
2ee40f16c2
qrexec-lib: fail peer_client_init call when domain dies
...
Don't wait indefinitely.
11 years ago
2739340559
qrexec-lib: fix memory leak
...
If xs_read returns pointer to empty string (len==0), then it was leaked.
11 years ago
a73be3f126
qubes-rpc/filecopy: send last processed filename for diagnostic purposes
...
This will ease solving transfer problems - sender will known at which
file it failed.
11 years ago
5131810265
qubes-rpc/filecopy: use explicit struct alignment
...
This is much more readable, than guessing exact struct packing done by
gcc on x86_64.
11 years ago
138d7899d9
Remove duplicated filecopy.h header
...
The same also exists as libqubes-rpc-filecopy.h.
11 years ago
42e133b753
Qrexec common code, qubes.Filecopy common code, udev scripts
12 years ago
Marek Marczykowski-Górecki