Set the permissions correctly on the XML-RPC UDP socket, so that non-root users

cannot use the socket.

This closes a security hole, and fixes the intermittent failure
of xm-test/06_list_nonroot.test.

c.f. xen-unstable changeset 9205:faa1eb1621b9 (same bug, different socket).

Signed-off-by: Ewan Mellor <ewan@xensource.com>

diff --git a/tools/python/xen/util/xmlrpclib2.py b/tools/python/xen/util/xmlrpclib2.py
index 214a678facd042f987c1a0ea27beff23325d51e6..c0f769f6f23ff6d6dc60aa191b3be1e02ddc93a0 100644 (file)
--- a/tools/python/xen/util/xmlrpclib2.py
+++ b/tools/python/xen/util/xmlrpclib2.py
@@ -23,7 +23,7 @@ An enhanced XML-RPC client/server interface for Python.
 from httplib import HTTPConnection, HTTP
 from xmlrpclib import Transport
 from SimpleXMLRPCServer import SimpleXMLRPCServer, SimpleXMLRPCRequestHandler
-import xmlrpclib, socket, os
+import xmlrpclib, socket, os, stat
 import SocketServer
 
 import xen.xend.XendClient
@@ -105,10 +105,13 @@ class UnixXMLRPCServer(TCPXMLRPCServer):
     address_family = socket.AF_UNIX
 
     def __init__(self, addr, logRequests):
-        if self.allow_reuse_address:
-            try:
+        parent = os.path.dirname(addr)
+        if os.path.exists(parent):
+            os.chown(parent, os.geteuid(), os.getegid())
+            os.chmod(parent, stat.S_IRWXU)
+            if self.allow_reuse_address and os.path.exists(addr):
                 os.unlink(addr)
-            except OSError, exc:
-                pass
+        else:
+            os.makedirs(parent, stat.S_IRWXU)
         TCPXMLRPCServer.__init__(self, addr, UnixXMLRPCRequestHandler,
                                  logRequests)

diff --git a/tools/python/xen/xend/XendClient.py b/tools/python/xen/xend/XendClient.py
index 974f4b71217c2f5add70545e997940ec5a4cb194..fb9974aa5aee374c032f91173000876f564a6eb5 100644 (file)
--- a/tools/python/xen/xend/XendClient.py
+++ b/tools/python/xen/xend/XendClient.py
@@ -19,10 +19,10 @@
 
 from xen.util.xmlrpclib2 import ServerProxy
 
-XML_RPC_SOCKET = "/var/run/xend-xmlrpc.sock"
+XML_RPC_SOCKET = "/var/run/xend/xmlrpc.sock"
 
 ERROR_INTERNAL = 1
 ERROR_GENERIC = 2
 ERROR_INVALID_DOMAIN = 3
 
-server = ServerProxy('httpu:///var/run/xend-xmlrpc.sock')
+server = ServerProxy('httpu:///var/run/xend/xmlrpc.sock')