From 6159d36e767fd9e175830751de0c8c28bd3e553b Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Mon, 20 Jul 2026 16:42:22 +0100 Subject: [PATCH] sysctl/Flask: add preliminary check for XEN_SYSCTL_getdomaininfolist To shield the sysctl lock from abuse by unauthorized domains, follow what 5154fdda1124 ("domctl: protect locking for get_domain_state") did: Check for permission to issue the operation against DOM_XEN in flask_sysctl(). The finer-grained xsm_getdomaininfo() later in the handling of the sub-op remains unaltered. In the in-tree policy respective permission therefore needs granting. This is part of CVE-2026-62426 / XSA-499. Signed-off-by: Jan Beulich Reviewed-by: Andrew Cooper Acked-by: Daniel P. Smith (cherry picked from commit 3179bf29311f9ed54b931bc95782b061afec5897) --- tools/flask/policy/modules/xen.if | 1 + xen/xsm/flask/hooks.c | 4 +++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/tools/flask/policy/modules/xen.if b/tools/flask/policy/modules/xen.if index def60da883..c9f85545a4 100644 --- a/tools/flask/policy/modules/xen.if +++ b/tools/flask/policy/modules/xen.if @@ -90,6 +90,7 @@ define(`create_domain_build_label', ` # manage_domain(priv, target) # Allow managing a running domain define(`manage_domain', ` + allow $1 domxen_t:domain getdomaininfo; allow $1 $2:domain { getdomaininfo getvcpuinfo getaffinity getaddrsize pause unpause trigger shutdown destroy setaffinity setdomainmaxmem getscheduler resume diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c index e0cce78bec..f9448b3deb 100644 --- a/xen/xsm/flask/hooks.c +++ b/xen/xsm/flask/hooks.c @@ -901,7 +901,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) { /* These have individual XSM hooks */ case XEN_SYSCTL_readconsole: - case XEN_SYSCTL_getdomaininfolist: case XEN_SYSCTL_page_offline_op: #ifdef CONFIG_X86 case XEN_SYSCTL_cpu_hotplug: @@ -948,6 +947,9 @@ static int cf_check flask_sysctl(const struct xen_sysctl *op) case XEN_SYSCTL_get_cpu_policy: return domain_has_xen(current->domain, XEN__PHYSINFO); + case XEN_SYSCTL_getdomaininfolist: + return flask_getdomaininfo(dom_xen); + case XEN_SYSCTL_psr_cmt_op: return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2, XEN2__PSR_CMT_OP, NULL);