Messages in this thread | | | Date | Sun, 3 Oct 2021 12:18:57 +0200 | From | Christoph Hellwig <> | Subject | Re: [RFC PATCH] nvme: allow specific passthrough IOs without CAP_SYSADMIN |
| |
On Sun, Oct 03, 2021 at 12:29:22PM +0300, Sagi Grimberg wrote: >> Users that want to send any of these passthrough commands will still >> require access to the NVMe char device or namespace. Typically, the >> char device is only accessible by root anyway and namespaces are >> accessible by root and the disk group. Administrators are free to >> add udev rules to adjust these permissions for specific devices they >> want to allow. > > I don't understand what is the difference between VS commands and normal > commands? Why do you consider VS commands safe to relax privileges as > opposed to any other command?
They are different in that it is cometely undefine what they do. So relaxing that checks is an absolute non-starter while for simple things like Read it might be possible if we really care.
| |