From: Edwin Török Date: Tue, 15 Dec 2020 11:28:56 +0000 (+0100) Subject: tools/ocaml/xenstored: check privilege for XS_IS_DOMAIN_INTRODUCED X-Git-Tag: archive/raspbian/4.14.0+88-g1d1d1f5391-2+rpi1^2~22 X-Git-Url: https://dgit.raspbian.org/?a=commitdiff_plain;h=aaf56fd686241f613e2aa6841e4e9068bdf3a90b;p=xen.git tools/ocaml/xenstored: check privilege for XS_IS_DOMAIN_INTRODUCED The Xenstore command XS_IS_DOMAIN_INTRODUCED should be possible for privileged domains only (the only user in the tree is the xenpaging daemon). This is part of XSA-115. Signed-off-by: Edwin Török Acked-by: Christian Lindig Reviewed-by: Andrew Cooper --- diff --git a/tools/ocaml/xenstored/process.ml b/tools/ocaml/xenstored/process.ml index 2fa6798e3b..fd79ef564f 100644 --- a/tools/ocaml/xenstored/process.ml +++ b/tools/ocaml/xenstored/process.ml @@ -166,7 +166,9 @@ let do_setperms con t _domains _cons data = let do_error _con _t _domains _cons _data = raise Define.Unknown_operation -let do_isintroduced _con _t domains _cons data = +let do_isintroduced con _t domains _cons data = + if not (Connection.is_dom0 con) + then raise Define.Permission_denied; let domid = match (split None '\000' data) with | domid :: _ -> int_of_string domid