[xen staging] pygrub: security-supported only when run de-privileged

[patchbot@xxxxxxx]

commit 75f920bd47a4f59eaaa4596aa3f4e12a447d26d2
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Mon Jul 20 16:28:30 2026 +0100
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Tue Jul 28 12:40:10 2026 +0100

    pygrub: security-supported only when run de-privileged
    
    XSA-443 and XSA-497 addressed specific issues in specific file system
    drivers (libfsimage) used by pygrub. Further issues were reported, and yet
    more are to be expected. XSA-443 introduced a means to run pygrub de-
    privileged. Only this mode of operation is security supported from now on.
    
    This is XSA-508.
    
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Juergen Gross <jgross@xxxxxxxx>
---
 SUPPORT.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/SUPPORT.md b/SUPPORT.md
index 55f2b0d102..eb07332462 100644
--- a/SUPPORT.md
+++ b/SUPPORT.md
@@ -288,6 +288,12 @@ or itself will not be regarded a security issue.
     Status, untrusted driver domains: Supported, not security supported
     Status, Liveupdate: Not functional
 
+## Guest boot loaders
+
+### Pygrub
+
+    Status: Supported, security supported only when run de-privileged
+
 ## Toolstack/3rd party
 
 ### libvirt driver for xl
--
generated by git-patchbot for /home/xen/git/xen.git#staging