On Tue, 12 Jun 2012 18:08:32 +0200 Paolo Bonzini <pbonzini@xxxxxxxxxx> wrote: > Persistent reservations commands cannot be issued right now without > giving CAP_SYS_RAWIO to the process who wishes to send them. This > is a bit heavy-handed, allow these two commands. > > Signed-off-by: Paolo Bonzini <pbonzini@xxxxxxxxxx> > --- > Ok for 3.5 as well? NAK. Persistent reservations are exactly the kind of command that should have a security model attached to them. Red Hat seems to be an ever growing source of "mummy its hard, lets disable all the security" type fixes. Please stop it. There is a sensible debate to be had about whether a lesser privilege ought to be allowed. The real fix to this as with half of the other crazy attempts to break all the security models that seem to keep spewing forth is for someone who cares about it (that seems to me Red Hat) add support for pushing a BPF filter onto a block device command queue. All the supporting code is there and used for other stuff, we can even jit the things, not that it's a fast path here. Alan -- To unsubscribe from this list: send the line "unsubscribe linux-scsi" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
