[xen stable-4.20] sysctl/Flask: add preliminary check for XEN_SYSCTL_getdomaininfolist

[patchbot@xxxxxxx]

commit 5ddc8866620d12354c2469e95f86a0c9aeb1bc00
Author:     Jan Beulich <jbeulich@xxxxxxxx>
AuthorDate: Mon Jul 20 16:41:00 2026 +0100
Commit:     Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
CommitDate: Tue Jul 28 13:08:27 2026 +0100

    sysctl/Flask: add preliminary check for XEN_SYSCTL_getdomaininfolist
    
    To shield the sysctl lock from abuse by unauthorized domains, follow what
    5154fdda1124 ("domctl: protect locking for get_domain_state") did: Check
    for permission to issue the operation against DOM_XEN in flask_sysctl().
    The finer-grained xsm_getdomaininfo() later in the handling of the sub-op
    remains unaltered.
    
    In the in-tree policy respective permission therefore needs granting.
    
    This is part of CVE-2026-62426 / XSA-499.
    
    Signed-off-by: Jan Beulich <jbeulich@xxxxxxxx>
    Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>
    Acked-by: Daniel P. Smith <dpsmith@xxxxxxxxxxxxxxxxxxxx>
    (cherry picked from commit 3179bf29311f9ed54b931bc95782b061afec5897)
---
 tools/flask/policy/modules/xen.if | 1 +
 xen/xsm/flask/hooks.c             | 4 +++-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/tools/flask/policy/modules/xen.if 
b/tools/flask/policy/modules/xen.if
index f7cf7c43c8..f996767535 100644
--- a/tools/flask/policy/modules/xen.if
+++ b/tools/flask/policy/modules/xen.if
@@ -90,6 +90,7 @@ define(`create_domain_build_label', `
 # manage_domain(priv, target)
 #   Allow managing a running domain
 define(`manage_domain', `
+       allow $1 domxen_t:domain getdomaininfo;
        allow $1 $2:domain { getdomaininfo getvcpuinfo getaffinity
                        getaddrsize pause unpause trigger shutdown destroy
                        setaffinity setdomainmaxmem getscheduler resume
diff --git a/xen/xsm/flask/hooks.c b/xen/xsm/flask/hooks.c
index 4dc8679ca3..934ed334c2 100644
--- a/xen/xsm/flask/hooks.c
+++ b/xen/xsm/flask/hooks.c
@@ -907,7 +907,6 @@ static int cf_check flask_sysctl(const struct xen_sysctl 
*op)
     {
     /* These have individual XSM hooks */
     case XEN_SYSCTL_readconsole:
-    case XEN_SYSCTL_getdomaininfolist:
     case XEN_SYSCTL_page_offline_op:
 #ifdef CONFIG_X86
     case XEN_SYSCTL_cpu_hotplug:
@@ -954,6 +953,9 @@ static int cf_check flask_sysctl(const struct xen_sysctl 
*op)
     case XEN_SYSCTL_get_cpu_policy:
         return domain_has_xen(current->domain, XEN__PHYSINFO);
 
+    case XEN_SYSCTL_getdomaininfolist:
+        return flask_getdomaininfo(dom_xen);
+
     case XEN_SYSCTL_psr_cmt_op:
         return avc_current_has_perm(SECINITSID_XEN, SECCLASS_XEN2,
                                     XEN2__PSR_CMT_OP, NULL);
--
generated by git-patchbot for /home/xen/git/xen.git#stable-4.20