[xen staging-4.20] pygrub: security-supported only when run de-privileged

[patchbot@xxxxxxx]

commit c42374a1052a20eac4ecfd38e32384b3b77eabd6
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Mon Jul 20 16:41:41 2026 +0100
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Tue Jul 28 13:08:27 2026 +0100

    pygrub: security-supported only when run de-privileged
    
    XSA-443 and XSA-497 addressed specific issues in specific file system
    drivers (libfsimage) used by pygrub. Further issues were reported, and yet
    more are to be expected. XSA-443 introduced a means to run pygrub de-
    privileged. Only this mode of operation is security supported from now on.
    
    This is XSA-508.
    
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Juergen Gross <jgross@xxxxxxxx>
    (cherry picked from commit 75f920bd47a4f59eaaa4596aa3f4e12a447d26d2)
---
 SUPPORT.md | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/SUPPORT.md b/SUPPORT.md
index 7db7ce9c3e..05822aec1d 100644
--- a/SUPPORT.md
+++ b/SUPPORT.md
@@ -275,6 +275,12 @@ Support for running qemu-xen device model in a linux 
stubdomain.
     Status, untrusted driver domains: Supported, not security supported
     Status, Liveupdate: Not functional
 
+## Guest boot loaders
+
+### Pygrub
+
+    Status: Supported, security supported only when run de-privileged
+
 ## Toolstack/3rd party
 
 ### libvirt driver for xl
--
generated by git-patchbot for /home/xen/git/xen.git#staging-4.20