From 69cc968847f6f459f923925d05f458aec3557781 Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Mon, 20 Jul 2026 16:44:43 +0100 Subject: [PATCH] pygrub: security-supported only when run de-privileged XSA-443 and XSA-497 addressed specific issues in specific file system drivers (libfsimage) used by pygrub. Further issues were reported, and yet more are to be expected. XSA-443 introduced a means to run pygrub de- privileged. Only this mode of operation is security supported from now on. This is XSA-508. Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit 75f920bd47a4f59eaaa4596aa3f4e12a447d26d2) --- SUPPORT.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/SUPPORT.md b/SUPPORT.md index 39e550e7a3..e37528fade 100644 --- a/SUPPORT.md +++ b/SUPPORT.md @@ -237,6 +237,12 @@ Support for running qemu-xen device model in a linux stubdomain. Status, untrusted driver domains: Supported, not security supported Status, Liveupdate: Not functional +## Guest boot loaders + +### Pygrub + + Status: Supported, security supported only when run de-privileged + ## Toolstack/3rd party ### libvirt driver for xl