Jan Beulich 5ddc886662 sysctl/Flask: add preliminary check for XEN_SYSCTL_getdomaininfolist ...

To shield the sysctl lock from abuse by unauthorized domains, follow what
5154fdda11 ("domctl: protect locking for get_domain_state") did: Check
for permission to issue the operation against DOM_XEN in flask_sysctl().
The finer-grained xsm_getdomaininfo() later in the handling of the sub-op
remains unaltered.

In the in-tree policy respective permission therefore needs granting.

This is part of CVE-2026-62426 / XSA-499.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Daniel P. Smith <dpsmith@apertussolutions.com>
(cherry picked from commit 3179bf2931)

2026-07-28 13:08:27 +01:00

..

9pfsd

tools: add a dedicated header file for barrier definitions

2024-12-19 10:04:45 +01:00

console

tools/console: Add escape argument to configure escape character

2023-07-27 09:47:33 +02:00

debugger

tools: Use new xc function for some xc_domain_getinfo() calls

2023-05-10 19:59:27 +01:00

examples

tools/examples: Remove more obsolete content

2024-07-30 17:36:51 +01:00

firmware

hvmloader: fix SMBIOS table length checks

2025-09-03 13:58:03 +02:00

flask

sysctl/Flask: add preliminary check for XEN_SYSCTL_getdomaininfolist

2026-07-28 13:08:27 +01:00

fuzz

x86emul/test: rename "cp"

2024-09-04 16:06:21 +02:00

golang

tools: add support for cache coloring configuration

2024-12-19 19:24:31 +01:00

helpers

Revert "xen/arm: Alloc XenStore page for Dom0less DomUs from hypervisor"

2024-06-19 12:48:47 +01:00

hotplug

tools: fix typo in sysconfig.xencommons.in

2025-02-11 17:09:00 +00:00

include

tools/sd-notify.h: Include string.h too

2026-03-06 14:49:09 +01:00

libacpi

Revert "libacpi: Pass missing --dm_version to mk_dsdt"

2026-04-20 17:31:14 +02:00

libfsimage

libfsimage/iso9660: harden Rock Ridge SUSP parsing against malformed lengths

2026-07-28 13:08:27 +01:00

libs

libxl: constify some local variables for building with glibc 2.43

2026-03-06 14:48:02 +01:00

misc

mktarball: Drop double-processing of the archive

2025-11-13 15:59:19 +00:00

ocaml

tools/ocaml/xb: Fix handling of requests with len = 0 for socket connections

2026-07-14 23:51:22 +01:00

pygrub

tools: Fix regex syntax warnings with Python 3.12

2024-12-18 13:18:19 +00:00

python

tools: don't expose XENFEAT_hvm_pirqs by default

2024-01-25 17:46:57 +00:00

tests

x86emul: V{,P}{COMPRESS,EXPAND}* can (wrongly) trigger assertion

2026-07-20 13:32:30 +02:00

vchan

tools: Use new xc function for some xc_domain_getinfo() calls

2023-05-10 19:59:27 +01:00

xcutils

tools/lsevtchn: Use errno macro to handle hypercall error cases

2024-08-02 08:43:57 +02:00

xenmon

tools: Make some callers of xc_domain_getinfo() use xc_domain_getinfolist()

2023-04-28 14:34:40 +01:00

xenpaging

tools: Modify single-domid callers of xc_domain_getinfolist()

2023-05-10 19:59:27 +01:00

xenpmd

tools: Remove -Werror everywhere else

2022-10-14 16:17:41 +01:00

xenstored

tools/xenstored: make conn_delete_all_transactions() idempotent

2026-04-28 13:43:55 +01:00

xentop

tools/xentop: Fix cpu% sort order

2024-05-15 19:59:52 +01:00

xentrace

xenalyze: correct symbol name length fscanf() specifier

2025-08-04 15:22:34 +02:00

xl

tools/xl: don't crash on NULL command line

2025-08-04 15:22:13 +02:00

xs-clients

tools/xs-clients: Fix make clean rule

2024-07-04 11:32:55 +01:00

config.h.in

build: Regenerate ./configure with Autoconf 2.71

2024-07-08 14:46:12 +01:00

configure

Re-run ./autogens.h for 4.20

2024-07-18 16:00:52 +01:00

configure.ac

build: Drop libiconv as a build dependecy

2024-07-09 18:10:52 +01:00

cross-install

cross-install: Only apply in tools directory, and automatically wrap $INSTALL.

2008-08-30 08:36:02 +01:00

Makefile

mktarball: only archive Xen

2024-09-04 16:07:41 +02:00

Rules.mk

Switch to release builds by default

2025-02-21 14:58:54 +00:00