Refuse names that would not be accessible in /run/qubes-service anyway

This applies to '.', '..' and anything with a slash.
Technically those services can still be accessible via qubesdb, but
that's not really intuitive and may look like a silent failure.
But since technically those can be seen by a VM, do not exclude them
from qubesdb, if somebody already set some of those names. Refuse only
new values.

QubesOS/qubes-issues#9274

(cherry picked from commit 1ff10c9)

qubes/ext/services.py

@@ -87,6 +87,15 @@ def on_domain_feature_pre_set(self, vm, event, feature,
         if not service:
             raise qubes.exc.QubesValueError(
                     'Service name cannot be empty')
+
+        if '/' in service:
+            raise qubes.exc.QubesValueError(
+                    'Service name cannot contain a slash')
+
+        if service in ('.', '..'):
+            raise qubes.exc.QubesValueError(
+                    'Service name cannot be "." or ".."')
+
         if len(service) > 48:
             raise qubes.exc.QubesValueError(
                     'Service name must not exceed 48 bytes')

qubes/tests/ext.py

@@ -487,6 +487,13 @@ def test_002_feature_delete(self):
             ('rm', ('/qubes-service/test3',), {}),
         ])
 
+    def test_003_feature_set_invalid(self):
+        for val in ('', '.', 'a/b', 'aa' * 30):
+            with self.assertRaises(qubes.exc.QubesValueError):
+                self.ext.on_domain_feature_pre_set(self.vm,
+                    'feature-set:service.' + val,
+                    'service.' + val, '1')
+
     def test_010_supported_services(self):
         self.ext.supported_services(self.vm, 'features-request',
             untrusted_features={