On Tue, 2012-09-11 at 19:56 +0200, Paolo Bonzini wrote:
> The set of use cases is so variable that no single filter can accomodate
> all of them: high availability people want persistent reservations, NAS
> people want trim/discard, but these are just two groups. Someone is
> using a Windows VM to run vendor tools and wants to have access to
> vendor-specific commands.
>
> You can tell this last group to use root, but not everyone else who is
> already relying on Unix permissions, SELinux and/or device cgroups to
> confine their virtual machines.
This is why the whole filter thing was mutable via sysfs. That way the
admin could set this up per device. It sounds like this is what you
want to fix, rather than opening up more holes in an already leaky
security apparatus. The ideal is that we would be much more restrictive
by default and give root the ability to override this both globally and
per-device to conform to whatever policy it has for the virtual
environments.
The patch which removed all of the sysfs pieces was:
commit 018e0446890661504783f92388ecce7138c1566d
Author: Jens Axboe <jens.axboe@xxxxxxxxxx>
Date: Fri Jun 26 16:27:10 2009 +0200
block: get rid of queue-private command filter
So that's probably the place to start for putting it back properly.
James
--
To unsubscribe from this list: send the line "unsubscribe linux-scsi" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
