Only fail because we're not a privileged domain after performing all
other checks (permissions & valid level).
unsigned int old_io_pl = current->thread.io_pl;
dom0_op_t op;
- if (!(start_info.flags & SIF_PRIVILEGED))
- return -EPERM;
-
if (new_io_pl > 3)
return -EINVAL;
if ((new_io_pl > old_io_pl) && !capable(CAP_SYS_RAWIO))
return -EPERM;
+ if (!(start_info.flags & SIF_PRIVILEGED))
+ return -EPERM;
+
/* Maintain OS privileges even if user attempts to relinquish them. */
if (new_io_pl == 0)
new_io_pl = 1;