Re: [Xen-devel] [PATCH v2 4/4] x86/hvm: add stricter permissions checks to ioreq server control plane

2018-03-20 Thread Jan Beulich
>>> On 16.03.18 at 17:58, wrote: > There has always been an intention in the ioreq server API that only the > domain that creates an ioreq server should be able to manipulate it. > However, so far, nothing has enforced this. This means that two domains > with DM_PRIV over a target domain can curre

[Xen-devel] [PATCH v2 4/4] x86/hvm: add stricter permissions checks to ioreq server control plane

2018-03-16 Thread Paul Durrant
There has always been an intention in the ioreq server API that only the domain that creates an ioreq server should be able to manipulate it. However, so far, nothing has enforced this. This means that two domains with DM_PRIV over a target domain can currently manipulate each others ioreq servers.