From c42374a1052a20eac4ecfd38e32384b3b77eabd6 Mon Sep 17 00:00:00 2001 From: Jan Beulich Date: Mon, 20 Jul 2026 16:41:41 +0100 Subject: [PATCH] pygrub: security-supported only when run de-privileged XSA-443 and XSA-497 addressed specific issues in specific file system drivers (libfsimage) used by pygrub. Further issues were reported, and yet more are to be expected. XSA-443 introduced a means to run pygrub de- privileged. Only this mode of operation is security supported from now on. This is XSA-508. Signed-off-by: Jan Beulich Reviewed-by: Juergen Gross (cherry picked from commit 75f920bd47a4f59eaaa4596aa3f4e12a447d26d2) --- SUPPORT.md | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/SUPPORT.md b/SUPPORT.md index 7db7ce9c3e..05822aec1d 100644 --- a/SUPPORT.md +++ b/SUPPORT.md @@ -275,6 +275,12 @@ Support for running qemu-xen device model in a linux stubdomain. Status, untrusted driver domains: Supported, not security supported Status, Liveupdate: Not functional +## Guest boot loaders + +### Pygrub + + Status: Supported, security supported only when run de-privileged + ## Toolstack/3rd party ### libvirt driver for xl