Jan Beulich 6159d36e76 sysctl/Flask: add preliminary check for XEN_SYSCTL_getdomaininfolist ...

To shield the sysctl lock from abuse by unauthorized domains, follow what
5154fdda11 ("domctl: protect locking for get_domain_state") did: Check
for permission to issue the operation against DOM_XEN in flask_sysctl().
The finer-grained xsm_getdomaininfo() later in the handling of the sub-op
remains unaltered.

In the in-tree policy respective permission therefore needs granting.

This is part of CVE-2026-62426 / XSA-499.

Signed-off-by: Jan Beulich <jbeulich@suse.com>
Reviewed-by: Andrew Cooper <andrew.cooper3@citrix.com>
Acked-by: Daniel P. Smith <dpsmith@apertussolutions.com>
(cherry picked from commit 3179bf2931)

2026-07-28 13:08:52 +01:00

..

policy

sysctl/Flask: add preliminary check for XEN_SYSCTL_getdomaininfolist

2026-07-28 13:08:52 +01:00

utils

flask/label-pci: Allow specifying optional irq label

2023-03-14 10:46:00 +01:00

Makefile

Makefile: Fix uninstall target

2017-07-28 17:47:42 +01:00