ae8a049aec
- Add warning if /kern/xen/privcmd is not readable
Fixes the following critical vulnerabilities:
* CVE-2013-1918 / XSA-45:
Several long latency operations are not preemptible
* CVE-2013-1952 / XSA-49:
VT-d interrupt remapping source validation flaw for bridges
* CVE-2013-2076 / XSA-52:
Information leak on XSAVE/XRSTOR capable AMD CPUs
* CVE-2013-2077 / XSA-53:
Hypervisor crash due to missing exception recovery on XRSTOR
* CVE-2013-2078 / XSA-54:
Hypervisor crash due to missing exception recovery on XSETBV
* CVE-2013-2194, CVE-2013-2195, CVE-2013-2196 / XSA-55:
Multiple vulnerabilities in libelf PV kernel handling
* CVE-2013-2072 / XSA-56:
Buffer overflow in xencontrol Python bindings affecting xend
* CVE-2013-2211 / XSA-57:
libxl allows guest write access to sensitive console related xenstore keys
* CVE-2013-1432 / XSA-58:
Page reference counting error due to XSA-45/CVE-2013-1918 fixes
* XSA-61:
libxl partially sets up HVM passthrough even with disabled iommu
The following minor vulnerability is also being addressed:
* CVE-2013-2007 / XSA-51
qemu guest agent (qga) insecure file permissions
Among many bug fixes and improvements:
* addressing a regression from the fix for XSA-46
* bug fixes to low level system state handling, including certain
hardware errata workarounds
106 lines
2.3 KiB
Bash
106 lines
2.3 KiB
Bash
#!@RCD_SCRIPTS_SHELL@
|
|
#
|
|
# PROVIDE: xencommons
|
|
# REQUIRE: DAEMON
|
|
|
|
. /etc/rc.subr
|
|
|
|
name="xencommons"
|
|
rcvar=$name
|
|
start_precmd="xen_precmd"
|
|
start_cmd="xen_startcmd"
|
|
stop_cmd="xen_stop"
|
|
status_cmd="xen_status"
|
|
extra_commands="status"
|
|
required_files="/kern/xen/privcmd"
|
|
|
|
XENSTORED_PIDFILE="/var/run/xenstored.pid"
|
|
XENCONSOLED_PIDFILE="/var/run/xenconsoled.pid"
|
|
|
|
BINDIR=@PREFIX@/bin
|
|
SBINDIR=@PREFIX@/sbin
|
|
|
|
xen_precmd()
|
|
{
|
|
mkdir -p /var/run/xen || exit 1
|
|
mkdir -p /var/run/xenstored || exit 1
|
|
}
|
|
|
|
xen_startcmd()
|
|
{
|
|
printf "Starting xenservices: xenstored, xenconsoled.\n"
|
|
if test ! -r ${required_files}; then
|
|
warn "${required_files} is not readable."
|
|
fi
|
|
XENSTORED_ARGS=" --pid-file ${XENSTORED_PIDFILE}"
|
|
if [ -n "${XENSTORED_TRACE}" ]; then
|
|
XENSTORED_ARGS="${XENSTORED_ARGS} -T /var/log/xen/xenstored-trace.log"
|
|
fi
|
|
|
|
${SBINDIR}/xenstored ${XENSTORED_ARGS}
|
|
sleep 5
|
|
|
|
printf "Setting domain 0 name...\n"
|
|
${BINDIR}/xenstore-write "/local/domain/0/name" "Domain-0"
|
|
|
|
XENCONSOLED_ARGS=""
|
|
if [ -n "${XENCONSOLED_TRACE}" ]; then
|
|
XENCONSOLED_ARGS="${XENCONSOLED_ARGS} --log=${XENCONSOLED_TRACE}"
|
|
fi
|
|
|
|
${SBINDIR}/xenconsoled ${XENCONSOLED_ARGS}
|
|
}
|
|
|
|
xen_stop()
|
|
{
|
|
pids=""
|
|
printf "Stopping xencommons"
|
|
|
|
rc_pid=$(check_pidfile ${XENCONSOLED_PIDFILE} ${SBINDIR}/xenconsoled)
|
|
pids="$pids $rc_pid"
|
|
rc_pid=$(check_pidfile ${XENSTORED_PIDFILE} ${SBINDIR}/xenstored)
|
|
pids="$pids $rc_pid"
|
|
|
|
kill -${sig_stop:-TERM} $pids
|
|
wait_for_pids $pids
|
|
|
|
printf ".\n"
|
|
}
|
|
|
|
xen_status()
|
|
{
|
|
xenstored_pid=$(check_pidfile ${XENSTORED_PIDFILE} ${SBINDIR}/xenstored)
|
|
if test -n ${xenstored_pid}; then
|
|
pids="$pids $xenstored_pid"
|
|
fi
|
|
|
|
xenconsoled_pid=$(check_pidfile ${XENCONSOLED_PIDFILE} ${SBINDIR}/xenconsoled)
|
|
if test -n ${xenconsoled_pid}; then
|
|
pids="$pids $xenconsoled_pid"
|
|
fi
|
|
|
|
if test -n "$xenconsoled_pid" -a -n "$xenstored_pid";
|
|
then
|
|
echo "xencommons are running as pids $pids."
|
|
return 0
|
|
fi
|
|
if test -a -z "$xenconsoled_pid" -a -z "$xenstored_pid";
|
|
then
|
|
echo "xencommons are not running."
|
|
return 0
|
|
fi
|
|
|
|
if test -n "$xenstored_pid"; then
|
|
echo "xenstored is running as pid $xenstored_pid."
|
|
else
|
|
echo "xenstored is not running."
|
|
fi
|
|
if test -n "$xenconsoled_pid"; then
|
|
echo "xenconsoled is running as pid $xenconsoled_pid."
|
|
else
|
|
echo "xenconsoled is not running."
|
|
fi
|
|
}
|
|
|
|
load_rc_config $name
|
|
run_rc_command "$1"
|