mirror of
https://github.com/ibm-s390-linux/s390-tools.git
synced 2026-08-05 02:14:52 +00:00
ce9c518b97
The cpictl utility sends control-program identification data from protected virtualization guests to hosts by default. This behaviour leaks the below potentially sensitive information to untrusted hosts. - system_type - system_level - sysplex_name - system_name To prevent this behaviour, enhance the cpictl utility to stop setting CPI information on protected virtualization guests by default. If the user chooses to set the CPI information, it could be set by one of the below options - use the command line option --permit-cpi - set the environment variable CPI_PERMIT_ON_PVGUEST to 1 to control the CPI service behaviour during boot Signed-off-by: Hendrik Brueckner <brueckner@linux.ibm.com> Signed-off-by: Shalini Chellathurai Saroja <shalini@linux.ibm.com> Reviewed-by: Jan Höppner <hoeppner@linux.ibm.com> Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com> Reviewed-by: Hendrik Brueckner <brueckner@linux.ibm.com> Signed-off-by: Jan Höppner <hoeppner@linux.ibm.com>