Il 02/05/2012 21:49, Jan Kara ha scritto: > I'm not sure they would be willing to try a different kernel because it's > a production system. But maybe I can find out what SG_IO command is sent > via strace? Yes. Hmm, you mentioned Veritas and that reminds me of https://bugzilla.redhat.com/show_bug.cgi?id=740504. If that is the case, the filesystem is simply pinging the destination with INQUIRY commands, something for which it would be worthwhile to have a non-privileged ioctl anyway. >>> Also I tend to side with Alan that I don't quite see >>> the point in trying to restrict CAP_SYS_RAWIO threads and thus breaking the >>> compatibility >> >> For example, we have a customer that wants this: >> >> * a VM should be able to send vendor-specific commands to a disk via >> SG_IO (vendor-specific commands require CAP_SYS_RAWIO). >> >> * they want to assign logical volumes or partitions to the same VM >> without letting it read or write outside the logical volume or partition. > > But then it seems like they really want to be able to forbid sending > SG_IO commands to some devices while allowing them for other devices and > the distinction by partition / non-partition is a bit arbitrary? Yes, forbidding SG_IO commands on some disks would be nice. Still, partition/non-partition is an important distinction. If you pass a whole disk and give CAP_SYS_RAWIO to QEMU, the guest may do some damage but not more than what a bare-metal system could do. If you pass a partition, the guest can stomp on other VMs or the host's data and even write them, which is a security problem. So you could add a more restrictive filter to partitions, but then you're adding hack above hack to justify a wrong decision. >> Of course a better solution for this would be customizable filters for >> SG_IO commands, where a privileged application would open the block >> device with CAP_SYS_RAWIO, set the filter and hand the file descriptor >> to QEMU. Or alternatively some extension of the device cgroup. But >> either solution would require a large amount of work. > > I'm not sure whether you need to filter individual SG_IO commands or not. > For your use case it seems that being able to forbid SG_IO completely for > some fd (which would be passed to qemu) would be enough? But maybe filters > are simpler to implement because they already exist, I don't really know... If you implement a yes/no toggle, some use case will pop up later for filters (in fact, a rudimentary filter based on CAP_SYS_RAWIO is _already_ in the kernel which already proves this). Paolo -- To unsubscribe from this list: send the line "unsubscribe linux-scsi" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
