Jan Beulich ae8dbf96a3 sysctl/Flask: add preliminary check for XEN_SYSCTL_getdomaininfolist ...

To shield the sysctl lock from abuse by unauthorized domains, follow what
5154fdda11 ("domctl: protect locking for get_domain_state") did: Check
for permission to issue the operation against DOM_XEN in flask_sysctl().
The finer-grained xsm_getdomaininfo() later in the handling of the sub-op
remains unaltered.

In the in-tree policy respective permission therefore needs granting.

This is part of CVE-2026-62426 / XSA-499.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Daniel P. Smith <dpsmith@apertussolutions.com>
(cherry picked from commit 3179bf2931)

2026-07-28 13:10:03 +01:00

..

console

tools/console: Add escape argument to configure escape character

2023-07-27 09:47:33 +02:00

debugger

tools: Use new xc function for some xc_domain_getinfo() calls

2023-05-10 19:59:27 +01:00

examples

tools/examples: cleanup Makefile

2022-07-11 12:13:24 +02:00

firmware

hvmloader/PCI: skip huge BARs in certain calculations

2024-03-12 12:06:57 +01:00

flask

sysctl/Flask: add preliminary check for XEN_SYSCTL_getdomaininfolist

2026-07-28 13:10:03 +01:00

fuzz

x86emul: rework wrapping of libc functions in test and fuzzing harnesses

2023-08-18 15:04:28 +02:00

golang

golang: Fix bindings after XSA-443

2023-11-07 09:59:06 +00:00

helpers

tools: Make init-xenstore-domain use xc_domain_getinfolist()

2023-04-28 14:34:40 +01:00

hotplug

block-common: Fix same_vm for no targets

2024-02-27 13:55:03 +01:00

include

tools: Import stand-alone sd_notify() implementation from systemd

2024-07-04 14:10:10 +02:00

libacpi

LICENSES: Remove the use of deprecated SPDX tags

2023-05-09 10:37:29 +01:00

libfsimage

libfsimage/iso9660: harden Rock Ridge SUSP parsing against malformed lengths

2026-07-28 13:10:03 +01:00

libs

libxl: constify some local variables for building with glibc 2.43

2026-03-17 18:23:50 +00:00

misc

mktarball: Use root/root for internal ownership

2025-11-13 16:58:17 +00:00

ocaml

tools/oxenstored: Reset quota when resetting permissions

2026-04-28 13:45:52 +01:00

pygrub

tools/pygrub: Fix pygrub's --entry flag for python3

2023-10-18 15:44:31 +01:00

python

tools/python: convert setup.py to use setuptools if available

2023-09-20 20:53:58 +01:00

tests

x86/stubs: Introduce place_ret() to abstract away raw 0xc3's

2025-05-12 17:30:55 +01:00

vchan

tools: Use new xc function for some xc_domain_getinfo() calls

2023-05-10 19:59:27 +01:00

xcutils

tools/lsevtchn: Use errno macro to handle hypercall error cases

2024-08-08 13:53:26 +02:00

xenmon

tools: Make some callers of xc_domain_getinfo() use xc_domain_getinfolist()

2023-04-28 14:34:40 +01:00

xenpaging

tools: Modify single-domid callers of xc_domain_getinfolist()

2023-05-10 19:59:27 +01:00

xenpmd

tools: Remove -Werror everywhere else

2022-10-14 16:17:41 +01:00

xenstored

tools/xenstored: make conn_delete_all_transactions() idempotent

2026-04-28 13:45:52 +01:00

xentop

tools/xentop: Fix cpu% sort order

2024-05-21 10:25:30 +02:00

xentrace

xenalyze: Reduce warnings about leaving a vcpu in INIT

2023-10-16 15:01:52 +01:00

xl

tools/xl: fix channel configuration setting

2025-03-20 13:32:19 +01:00

xs-clients

tools/xenstore: move xenstored sources into dedicated directory

2023-08-23 19:10:37 +01:00

config.h.in

tools/libxs: Fix CLOEXEC handling in xs_fileno()

2024-07-04 14:13:30 +02:00

configure

tools/libxs: Fix CLOEXEC handling in xs_fileno()

2024-07-04 14:13:30 +02:00

configure.ac

tools/libxs: Fix CLOEXEC handling in xs_fileno()

2024-07-04 14:13:30 +02:00

cross-install

cross-install: Only apply in tools directory, and automatically wrap $INSTALL.

2008-08-30 08:36:02 +01:00

Makefile

tools/xenstore: move xenstored sources into dedicated directory

2023-08-23 19:10:37 +01:00

Rules.mk

Turn off debug by default

2023-10-27 14:08:16 +01:00