ExternalVendorCode/genode
1
0
Fork 0
mirror of https://github.com/genodelabs/genode.git synced 2024-12-31 19:17:04 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity
38272b9172
genode/base-linux/include/base/ipc.h

39 lines
874 B
C
Raw Normal View History

Support for socket-descriptor marshalling This patch adds prinicipal support for transmitting socket descriptors as RPC payload. Socket descriptors are handled by the linux-specific implementation of the capability marshalling and unmarshalling functions in 'ipc.h'. The 'Message' type in 'src/platform/linux_socket.h' has been extended to carry multiple descriptors in a single message. Unfortuately, we hit a problem (and potential show stopper) here: lx_sendmsg failed with -109 in lx_call() The error code corresponds to ETOOMANYREFS. There is only one place in the Linux kernel where this error code is used (net/unix/af_unix.c). The code for 'unix_attach_fds()' suggests that there is a limit with regard to the maximum number of references for a given Unix domain socket. When the error occurs, core and init are running. The socket of core's server entrypoint is present in the '/proc/pid/fd' of those processes 8 times. The error occurs when core tries to perform an RPC to the entrypoint to perform 'Ram_session::transfer_quota()' (base/include/base/child.h at line 248).
2012-07-26 18:29:45 +00:00
/*
* \brief Linux-specific supplements to the IPC framework
* \author Norman Feske
* \date 2012-07-26
*/
/*
* Copyright (C) 2012 Genode Labs GmbH
*
* This file is part of the Genode OS framework, which is distributed
* under the terms of the GNU General Public License version 2.
*/
#ifndef _INCLUDE__BASE__IPC_H_
#define _INCLUDE__BASE__IPC_H_
#include <base/ipc_generic.h>
inline void Genode::Ipc_ostream::_marshal_capability(Genode::Native_capability const &cap)
{
_write_to_buf(cap.local_name());
Delegate access to entrypoints via SCM rights This patch eliminates the thread ID portion of the 'Native_capability' type. The access to entrypoints is now exclusively handled by passing socket descripts over Unix domain sockets and by inheriting the socket descriptor of the parent entrypoint at process-creation time. Each entrypoint creates a socket pair. The server-side socket is bound to a unique name defined by the server. The client-side socket is then connected to the same name. Whereas the server-side socket is meant to be exclusively used by the server to wait for incoming requests, the client-side socket can be delegated to other processes as payload of RPC messages (via SCM rights). Anyone who receives a capability over RPC receives the client-side socket of the entrypoint to which the capability refers. Given this socket descriptor, the unique name (as defined by the server) can be requested using 'getpeername'. Using this name, it is possible to compare socket descriptors, which is important to avoid duplicates from polluting the limited socket-descriptor name space. Wheras this patch introduces capability-based delegation of access rights to entrypoints, it does not cover the protection of the integrity of RPC objects. RPC objects are still referenced by a global ID passed as normal message payload.
2012-08-08 20:01:04 +00:00
if (cap.valid())
Support for socket-descriptor marshalling This patch adds prinicipal support for transmitting socket descriptors as RPC payload. Socket descriptors are handled by the linux-specific implementation of the capability marshalling and unmarshalling functions in 'ipc.h'. The 'Message' type in 'src/platform/linux_socket.h' has been extended to carry multiple descriptors in a single message. Unfortuately, we hit a problem (and potential show stopper) here: lx_sendmsg failed with -109 in lx_call() The error code corresponds to ETOOMANYREFS. There is only one place in the Linux kernel where this error code is used (net/unix/af_unix.c). The code for 'unix_attach_fds()' suggests that there is a limit with regard to the maximum number of references for a given Unix domain socket. When the error occurs, core and init are running. The socket of core's server entrypoint is present in the '/proc/pid/fd' of those processes 8 times. The error occurs when core tries to perform an RPC to the entrypoint to perform 'Ram_session::transfer_quota()' (base/include/base/child.h at line 248).
2012-07-26 18:29:45 +00:00
_snd_msg->append_cap(cap.dst().socket);
}
inline void Genode::Ipc_istream::_unmarshal_capability(Genode::Native_capability &cap)
{
long local_name = 0;
_read_from_buf(local_name);
Delegate access to entrypoints via SCM rights This patch eliminates the thread ID portion of the 'Native_capability' type. The access to entrypoints is now exclusively handled by passing socket descripts over Unix domain sockets and by inheriting the socket descriptor of the parent entrypoint at process-creation time. Each entrypoint creates a socket pair. The server-side socket is bound to a unique name defined by the server. The client-side socket is then connected to the same name. Whereas the server-side socket is meant to be exclusively used by the server to wait for incoming requests, the client-side socket can be delegated to other processes as payload of RPC messages (via SCM rights). Anyone who receives a capability over RPC receives the client-side socket of the entrypoint to which the capability refers. Given this socket descriptor, the unique name (as defined by the server) can be requested using 'getpeername'. Using this name, it is possible to compare socket descriptors, which is important to avoid duplicates from polluting the limited socket-descriptor name space. Wheras this patch introduces capability-based delegation of access rights to entrypoints, it does not cover the protection of the integrity of RPC objects. RPC objects are still referenced by a global ID passed as normal message payload.
2012-08-08 20:01:04 +00:00
int const socket = _rcv_msg->read_cap();
cap = Native_capability(Cap_dst_policy::Dst(socket), local_name);
Support for socket-descriptor marshalling This patch adds prinicipal support for transmitting socket descriptors as RPC payload. Socket descriptors are handled by the linux-specific implementation of the capability marshalling and unmarshalling functions in 'ipc.h'. The 'Message' type in 'src/platform/linux_socket.h' has been extended to carry multiple descriptors in a single message. Unfortuately, we hit a problem (and potential show stopper) here: lx_sendmsg failed with -109 in lx_call() The error code corresponds to ETOOMANYREFS. There is only one place in the Linux kernel where this error code is used (net/unix/af_unix.c). The code for 'unix_attach_fds()' suggests that there is a limit with regard to the maximum number of references for a given Unix domain socket. When the error occurs, core and init are running. The socket of core's server entrypoint is present in the '/proc/pid/fd' of those processes 8 times. The error occurs when core tries to perform an RPC to the entrypoint to perform 'Ram_session::transfer_quota()' (base/include/base/child.h at line 248).
2012-07-26 18:29:45 +00:00
}
#endif /* _INCLUDE__BASE__IPC_H_ */
Reference in New Issue Copy Permalink