From: Edwin Török Date: Tue, 15 Dec 2020 12:35:08 +0000 (+0100) Subject: tools/ocaml/xenstored: check privilege for XS_IS_DOMAIN_INTRODUCED X-Git-Tag: archive/raspbian/4.16.0+51-g0941d6cb-1+rpi1~2^2~42^2~1320 X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=67bfd6cd4b1b44882f2a549a8750e278338436e9;p=xen.git tools/ocaml/xenstored: check privilege for XS_IS_DOMAIN_INTRODUCED The Xenstore command XS_IS_DOMAIN_INTRODUCED should be possible for privileged domains only (the only user in the tree is the xenpaging daemon). This is part of XSA-115. Signed-off-by: Edwin Török Acked-by: Christian Lindig Reviewed-by: Andrew Cooper --- diff --git a/tools/ocaml/xenstored/process.ml b/tools/ocaml/xenstored/process.ml index 2fa6798e3b..fd79ef564f 100644 --- a/tools/ocaml/xenstored/process.ml +++ b/tools/ocaml/xenstored/process.ml @@ -166,7 +166,9 @@ let do_setperms con t _domains _cons data = let do_error _con _t _domains _cons _data = raise Define.Unknown_operation -let do_isintroduced _con _t domains _cons data = +let do_isintroduced con _t domains _cons data = + if not (Connection.is_dom0 con) + then raise Define.Permission_denied; let domid = match (split None '\000' data) with | domid :: _ -> int_of_string domid