From mboxrd@z Thu Jan  1 00:00:00 1970
From: Ian Jackson <Ian.Jackson@eu.citrix.com>
Subject: Re: [PATCH] tools: add XS_RESTRICT operation to C xenstore
	client libs.
Date: Fri, 2 Jul 2010 17:50:35 +0100
Message-ID: <19502.6363.477323.378577@mariner.uk.xensource.com>
References: <20100702124458.GK31695@whitby.uk.xensource.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <xen-devel-bounces@lists.xensource.com>
In-Reply-To: <20100702124458.GK31695@whitby.uk.xensource.com>
List-Unsubscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
List-Post: <mailto:xen-devel@lists.xensource.com>
List-Help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-Subscribe: <http://lists.xensource.com/mailman/listinfo/xen-devel>,
	<mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
Sender: xen-devel-bounces@lists.xensource.com
Errors-To: xen-devel-bounces@lists.xensource.com
To: Tim Deegan <Tim.Deegan@citrix.com>
Cc: xen-devel@lists.xensource.com
List-Id: xen-devel@lists.xenproject.org

Tim Deegan writes ("[Xen-devel] [PATCH] tools: add XS_RESTRICT operation to C xenstore client libs."):
> The OCaml xenstored supports the XS_RESTRICT operation, which
> deprivileges a dom0 xenstore connection so it can only affect one
> domain's entries.   Add the relevant definitions to the C libraries 
> so that callers can use it. 

Can you explain what this is for, please ?  If it's for security
against a hostile caller, what prevents the caller from simply opening
another xenstore connection ?

Ian.