Re: [Xen-devel] [PATCH 07/17] flask: unify {get, set}vcpucontext permissions

[Andrew Cooper <andrew.cooper3@xxxxxxxxxx>]

On 20/06/16 15:27, Doug Goldstein wrote:
> On 6/20/16 9:04 AM, Daniel De Graaf wrote:
>> These permissions were initially split because they were in separate
>> domctls, but this split is very unlikely to actually provide security
>> benefits: it would require a carefully contrived situation for a domain
>> to both need access to one type of CPU register and also need to be
>> prohibited from accessing another type.
>>
>> Signed-off-by: Daniel De Graaf <dgdegra@xxxxxxxxxxxxx>
>> Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@xxxxxxxxxx>
> I'm a:
>
> Reviewed-by: Doug Goldstein <cardoe@xxxxxxxxxx>
>
> But I'd like to see Andrew Cooper's R-b or comments as well.
>

I agree.  I can't see a plausible usecase for an entity being entitled
to read vcpu content, but not to modify it.

Reviewed-by: Andrew Cooper <andrew.cooper3@xxxxxxxxxx>

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxx
http://lists.xen.org/xen-devel