On 12/6/24 08:02, Juergen Gross wrote:
Today the dummy XSM privilege checks for getdomaininfo are less stringent than possible: they basically rely on the general sysctl/domctl entry check to do all tests and then do the test with the XSM_HOOK privilege, which is an "allow all" default. Instead of XSM_HOOK use XSM_XS_PRIV, which is the privilege really wanted. Note that this test is still wider than the sysctl entry test, but there is now easy way to make both domctl and sysctl happy at the same time. Signed-off-by: Juergen Gross <jgr...@suse.com>
Acked-by: Daniel P. Smith <dpsm...@apertussolutions.com>
