lkml.org 
[lkml]   [2021]   [Jun]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRe: [PATCH 2/2] blk-zoned: allow BLKREPORTZONE without CAP_SYS_ADMIN
    Date
    On 2021/06/03 18:54, David Sterba wrote:
    > On Mon, May 31, 2021 at 01:54:53PM +0000, Niklas Cassel wrote:
    >> From: Niklas Cassel <niklas.cassel@wdc.com>
    >>
    >> Performing a BLKREPORTZONE operation should be allowed under the same
    >> permissions as read(). (read() does not require CAP_SYS_ADMIN).
    >>
    >> Remove the CAP_SYS_ADMIN requirement, and instead check that the fd was
    >> successfully opened with FMODE_READ. This way BLKREPORTZONE will match
    >> the access control requirement of read().
    >
    > Does this mean that a process that does not have read nor write access
    > to the device itself (blocks) is capable of reading the zone
    > information? Eg. some monitoring tool.

    With this change, to do a report zones, the process will only need to have read
    access to the device. And if it has read access, it also means that it can read
    the zones content.


    --
    Damien Le Moal
    Western Digital Research

    \
     
     \ /
      Last update: 2021-06-03 12:00    [W:7.981 / U:0.036 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site