[lkml]   [2021]   [Jun]   [3]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [PATCH 2/2] blk-zoned: allow BLKREPORTZONE without CAP_SYS_ADMIN
    On 2021/06/03 18:54, David Sterba wrote:
    > On Mon, May 31, 2021 at 01:54:53PM +0000, Niklas Cassel wrote:
    >> From: Niklas Cassel <>
    >> Performing a BLKREPORTZONE operation should be allowed under the same
    >> permissions as read(). (read() does not require CAP_SYS_ADMIN).
    >> Remove the CAP_SYS_ADMIN requirement, and instead check that the fd was
    >> successfully opened with FMODE_READ. This way BLKREPORTZONE will match
    >> the access control requirement of read().
    > Does this mean that a process that does not have read nor write access
    > to the device itself (blocks) is capable of reading the zone
    > information? Eg. some monitoring tool.

    With this change, to do a report zones, the process will only need to have read
    access to the device. And if it has read access, it also means that it can read
    the zones content.

    Damien Le Moal
    Western Digital Research

     \ /
      Last update: 2021-06-03 12:00    [W:7.981 / U:0.036 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site