This looks ok to me, but do we even need to keep the special cases above? Is there anything relying on the safe but not very useful ioctls? Condensing the thing down to: int scsi_verify_blk_ioctl(struct block_device *bd, unsigned int cmd) { if (bd && bd == bd->bd_contains) return 0; if (capable(CAP_SYS_RAWIO)) return 0; return -ENOIOCTLCMD; } would certainly be nice.