ExternalVendorCode/genode
1
0
Fork 0
mirror of https://github.com/genodelabs/genode.git synced 2025-06-15 05:38:18 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Delegate access to entrypoints via SCM rights

Browse Source 
This patch eliminates the thread ID portion of the 'Native_capability'
type. The access to entrypoints is now exclusively handled by passing
socket descripts over Unix domain sockets and by inheriting the socket
descriptor of the parent entrypoint at process-creation time.

Each entrypoint creates a socket pair. The server-side socket is bound
to a unique name defined by the server. The client-side socket is then
connected to the same name. Whereas the server-side socket is meant to
be exclusively used by the server to wait for incoming requests, the
client-side socket can be delegated to other processes as payload of RPC
messages (via SCM rights). Anyone who receives a capability over RPC
receives the client-side socket of the entrypoint to which the
capability refers. Given this socket descriptor, the unique name (as
defined by the server) can be requested using 'getpeername'. Using this
name, it is possible to compare socket descriptors, which is important
to avoid duplicates from polluting the limited socket-descriptor name
space.

Wheras this patch introduces capability-based delegation of access
rights to entrypoints, it does not cover the protection of the integrity
of RPC objects. RPC objects are still referenced by a global ID passed
as normal message payload.
This commit is contained in:
Norman Feske
2012-08-08 22:01:04 +02:00
parent 64efaf249a
commit f33c7c73bd
10 changed files with 337 additions and 210 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
base-linux/include/base/platform_env.h
View File

@ -28,6 +28,7 @@
#include <parent/client.h>
#include <ram_session/client.h>
#include <cpu_session/client.h>
#include <pd_session/client.h>
namespace Genode {
@ -323,13 +324,12 @@ namespace Genode {
Parent_capability _parent_cap()
{
long tid = _get_env_ulong("parent_tid");
long local_name = _get_env_ulong("parent_local_name");
/* produce typed capability manually */
typedef Native_capability::Dst Dst;
return reinterpret_cap_cast<Parent>(Native_capability(Dst(tid, -1),
local_name));
Dst const dst(PARENT_SOCKET_HANDLE);
return reinterpret_cap_cast<Parent>(Native_capability(dst, local_name));
}
@ -343,6 +343,7 @@ namespace Genode {
Cpu_session_capability _cpu_session_cap;
Cpu_session_client _cpu_session_client;
Rm_session_mmap _rm_session_mmap;
Pd_session_client _pd_session_client;
Heap _heap;
public:
@ -358,6 +359,7 @@ namespace Genode {
_cpu_session_cap(static_cap_cast<Cpu_session>(parent()->session("Env::cpu_session", ""))),
_cpu_session_client(_cpu_session_cap),
_rm_session_mmap(false),
_pd_session_client(static_cap_cast<Pd_session>(parent()->session("Env::pd_session", ""))),
_heap(&_ram_session_client, &_rm_session_mmap)
{ }