On 03/02/2017 08:37, Christoph Hellwig wrote: > .. at least for unprivileged users. Before we called into the SCSI > ioctl code to allow excemptions for a few SCSI passthrough ioctls, > but this is pretty unsafe and except for this call dm knows nothing > about SCSI ioctls. > > As the SCSI ioctl code is now optional, we really don't want to > drag it in for DM, and the exception is not very useful anyway. > > Signed-off-by: Christoph Hellwig <hch@xxxxxx> > Acked-by: Mike Snitzer <snitzer@xxxxxxxxxx> > --- > drivers/md/dm.c | 13 ++++++++----- > 1 file changed, 8 insertions(+), 5 deletions(-) > > diff --git a/drivers/md/dm.c b/drivers/md/dm.c > index 9e958bc94fed..fd4331aa2e19 100644 > --- a/drivers/md/dm.c > +++ b/drivers/md/dm.c > @@ -465,13 +465,16 @@ static int dm_blk_ioctl(struct block_device *bdev, fmode_t mode, > > if (r > 0) { > /* > - * Target determined this ioctl is being issued against > - * a logical partition of the parent bdev; so extra > - * validation is needed. > + * Target determined this ioctl is being issued against a > + * subset of the parent bdev; require extra privileges. > */ > - r = scsi_verify_blk_ioctl(NULL, cmd); > - if (r) > + if (!capable(CAP_SYS_RAWIO)) { > + DMWARN_LIMIT( > + "%s: sending ioctl %x to DM device without required privilege.\n", > + current->comm, cmd); > + r = -ENOIOCTLCMD; > goto out; > + } > } > > r = __blkdev_driver_ioctl(bdev, mode, cmd, arg); > Acked-by: Paolo Bonzini <pbonzini@xxxxxxxxxx> Thanks, Paolo